NIST Abandons Comprehensive CVE Enrichment, Focuses on Critical Vulnerabilities

NIST's decision to stop enriching most CVEs signals a fundamental shift in how vulnerability data is managed globally. With tens of thousands of new CVEs reported annually and limited resources, the agency has concluded that attempting comprehensive enrichment is futile. This move will force vulnerability management companies to independently enrich non-critical vulnerability data, marking a significant transition away from a centralized source of truth.