NIST Opens NVD Modernization With an Unseen AI Tool
NIST has opened an RFI on modernizing the National Vulnerability Database while saying it has begun work on an unreleased AI tool called V-etalon. The disclosure comes after NIST cut most routine CVE enrichment and after a federal audit said the agency lacked a strategic plan and a sustainable way to keep up.
The mechanism is simple: V-etalon is meant to help enrich vulnerability records, but NIST has not published code, benchmarks, an operating model, or even a clear list of which fields it would fill in. That matters because downstream users may be asked to trust NVD output for scoring, CWE mapping, or applicability without an independent way to judge quality.
For teams and vendors that ingest NVD data, the issue is not a new flaw but a less visible upstream source. If NIST keeps the enrichment layer opaque, confidence in the feed may need to be proven separately rather than assumed from the NVD label.