Cybersecurity Dive Trendline on AI

LAS VEGAS — The global system that catalogs technology vulnerabilities is resilient enough to survive the current onslaught of AI-generated bug reports that has alarmed cybersecurity experts, key leaders of that system said during panels at two security conferences in early August.

The Common Vulnerabilities and Exposures (CVE) Program — whose unique vulnerability identifiers are the bedrock of the entire cybersecurity industry — “will find a way to scale,” Lindsey Cerkovnik, branch chief for vulnerability response and coordination at the Cybersecurity and Infrastructure Security Agency (CISA), said at the Black Hat USA conference. “CVE is going to continue to flourish and improve, and I feel very positively about it.”

At the same time, program leaders acknowledged the monumental problems they now face. “These [vulnerabilities] are coming out at an AI pace,” Elizabeth Eigner, a senior manager for cybersecurity policy at Microsoft, said at DEF CON, “but we’re still creating and processing them at a human scale.”

The CVE Program, managed by the nonprofit research organization MITRE and overseen by CISA, is facing the biggest challenge in its 27-year history, as security researchers flood the program with bug reports generated by advanced AI models. Commercial and open-source software developers alike have struggled to keep up with the deluge of vulnerability reports, some of which are completely inaccurate. And the CVE Program itself is still recovering from a crisis in early 2025 that left some cybersecurity experts questioning its future.

The issues have threatened to cripple a vulnerability database that is widely considered one of the world’s most important cybersecurity resources.

During panels at both conferences, speakers described a tidal wave of vulnerability reports that exceeded anything they had ever seen before. GitHub, one of the more than 530 CVE Numbering Authorities (CNAs) authorized to issue identifiers to new vulnerabilities, has published more than 7,000 of those identifiers so far in 2026, a figure that GitHub’s Madison Ficorilli said she believed to be an annual record for a CNA. “This is not a competition,” she said at DEF CON. “It is an alarming metric.”

CISA, too, has felt the squeeze. The agency’s vulnerability response team is dealing with between 360 and 400 cases at a time, Cerkovnik said. “It’s very clearly a difference from what we were seeing a year ago and prior to that,” she said at DEF CON. “What’s being reported to us is increasing.”

Even the world’s biggest tech companies are struggling.

“People ask me whether this is the new normal, and I say yeah, it is, for now anyway,” said Lisa Olson, a principal security program manager at Microsoft, a major CNA.

AI solutions to AI problems

The first four months of 2026 were full of “AI slop,” Ficorilli said at DEF CON, pointing to an endless stream of inaccurate AI-generated bug reports that flooded software maintainers. Since then, she said, the models have improved and begun generating mostly valid reports. But those improvements have also made flawed bug reports harder to identify. Ficorilli said the reports “can be so convincing and, therefore, then consume so much of your time that many times, it may be easier to just say, ‘OK, this looks valid enough. I'm just going to fix it.’”

While AI is fueling the crush of reports, it could also help vulnerability responders sift through the noise. AI models are sometimes better than humans at finding flaws, although their non-deterministic nature means they won’t always find the same flaws from the same source data.

CISA is looking closely at how to automate aspects of the vulnerability triage process as it tries to avoid overtaxing its limited staff.

“With such an increase in scale, where can I use those resources the best and the most efficiently?” Cerkovnik said at DEF CON. “How do I take a job that’s already really difficult and make sure that they are able to focus on the things that really matter?”

The CVE Program is also looking for ways to bring frontier AI labs deeper into the fold. The organization recently granted OpenAI and Anthropic temporary CNA status, letting them assign CVEs to vulnerabilities that their models discover in certain software. “That’s a really big change,” Cerkovnik said. “We are piloting it in order to learn as much as we possibly can.”

Know your biggest cyber risks

Amid the vulnerability avalanche, CISA is deeply concerned that organizations aren’t carefully prioritizing vulnerabilities and are getting overwhelmed — and as a result, inadvertently leaving major security gaps.

“I am concerned about the industry’s ability to scale via prioritization,” Cerkovnik said at Black Hat. “We cannot treat every vulnerability the same way.”

Security leaders, she added, “need to be thinking about how you're going to convince the person above you that not patching something, ever, is an option.”

CISA has urged private organizations to follow the guidance in its recent binding operational directive to federal agencies on vulnerability prioritization.

“Not all vulnerabilities matter, and even vulnerabilities that matter don’t all matter at the same level for you and your organization,” Cerkovnik said at DEF CON. “That’s not a popular thing to say, but it’s true.”

Don’t call it a “vulnpocalypse” (maybe)

People who work in vulnerability analysis are split over how daunting the challenge is. Those divisions were on display during a listening session that the CVE Program hosted several weeks ago to discuss AI’s impact on the landscape.

One person who presented at the event said, “Let’s kill the word ‘vulnpocalypse,’ because it’s just not accurate,” Cerkovnik recalled at Black Hat. She said she understood the objection. “Language matters. … It’s harder to take action on a serious threat when you give it a non-serious name and you talk about it in a way that makes it sound like it’s unsolvable.”

On the other hand, she said, people who run product security teams spoke at the listening session about how they were being "inundated” with reports of varying quality levels.

Global coordination

The CVE Program remains the cornerstone of the global vulnerability ecosystem, but it is no longer alone. In recent years, foreign governments have launched companion programs, including the EU Vulnerability Database (EUVD). Some cybersecurity experts have questioned whether the new programs will lead to fragmentation.

Speakers at the two conferences said that was not the case. The EUVD is built around CVE IDs, and Nuno Rodrigues Carvalho, the top vulnerability management official at the European Union Agency for Cybersecurity (ENISA), said at Black Hat that “we don’t see it as a duplication of effort whatsoever.”

“We don’t want a system in which there are multiple platforms that are not in sync with each other,” Microsoft’s Eigner said at DEF CON, but “there’s not a risk there, as it stands now, of two different systems emerging.”

CISA reassures skeptics

After CISA’s contract with MITRE to run the CVE Program nearly expired in April 2025, cybersecurity experts began questioning whether the U.S. government was the right steward for such a critical resource. In Las Vegas in early August, CISA’s Cerkovnik sought to reassure those critics.

“We’re more committed than ever,” she said at Black Hat, adding that CISA wants to make the program nimbler and more responsive to researchers’ needs. CISA is focused on improving both the quality of vulnerability records and the ease of the reporting process, she said.

Cerkovnik said the CVE Program is now on sound financial footing, but she acknowledged that 2025’s near-fiasco had reminded both CISA and the broader cybersecurity community of the program’s value.

“With the current emergence of AI-enabled vulnerability research and discovery,” she added, “that importance of the program is becoming more evident every single day.”

ENISA’s Carvalho said the world seemed committed to the program. “I don't think that another model or another way of doing things will come,” he said at Black Hat.

Not everyone was as confident. “Most of the regulators around the world think that CVE is still the way to go and should remain the standard,” Microsoft’s Olson said at DEF CON. “But I think the program has to really rise to the moment in order for some other competitive system to not take its place.”

Others were even more critical.

“I don’t think the CVE Program was designed to be able to manage [this] influx of vulnerabilities,” Katie Noble, a program board member who leads product security incident response for Intel, said at DEF CON. “I don’t think it is capable of keeping up at this point.”