CISA outlines new quality standards for CVE data amid AI-driven discovery

CISA has introduced a framework to improve the quality of Common Vulnerabilities and Exposures (CVE) data, arguing that vulnerability identification programs must mature to handle rising disclosure volumes. The program is shifting into a new era focused on reliability, responsiveness, and data quality. This shift occurs as AI tools accelerate discovery and increase the volume of submissions to repositories like the National Vulnerability Database (NVD).

The increased volume of CVE submissions, which saw a 263% increase between 2020 and 2025, puts pressure on the entire software lifecycle from development to disclosure. CISA noted that this acceleration exposes gaps in processes and accountability, fundamentally changing the economics of vulnerability research.