The US National Vulnerability Database has slipped from a dull but dependable piece of security plumbing into a sputtering liability. Enrichment of CVEs has stalled, backlogs have exploded, and defenders are left with raw identifiers instead of actionable intelligence. This collapse is not accidental—it is the predictable result of political austerity, funding cuts, and a fixation on flashy science over unglamorous infrastructure. In other words, the pipes have burst while Washington debates whether water is really a priority. For security teams all over the world, the message is blunt: stop waiting for rescue. Diversify your sources, automate your own triage, build peer networks, and treat metadata as survival gear, not a luxury.

A slow-motion collapse beneath everyone’s radar

The National Vulnerability Database (NVD) has not exactly been thriving. Since around mid-March 2024, enrichment of new CVEs has all but halted—only a fraction of entries have the vital metadata that security professionals rely on: CWE designations, CVSS scores, CPE data and the like. Imagine throwing thousands of vulnerabilities over the fence without bothering to label them. It is precisely that careless. Data shows that from 2,700 new CVEs only about 200 were actually enriched. Backlogs have worsened: from some 17,000 unprocessed CVEs in August 2024 to a staggering 25,000 by March 2025.

A resource-starved system gasping for air

You may recall tales of congressional funding. NIST, the agency behind the NVD, has been trying to carry on while its lifeline is gradually strangled. The Trump administration’s 2026 budget proposed slashing $325 million from NIST’s discretionary funds, including particularly nasty cuts to cybersecurity and privacy programmes. It did not go that far.

Beyond NIST, the broader scientific funding ecosystem has been slashed to ribbons.

A political posture that says “sorry, not sorry” to science

One gets the sense that maintaining something as dull and foundational as the NVD does not quite align with the Trump ethos of flashy breakthroughs and “economic security.” Indeed, ideological purges—including stripped LGBTQ+, climate-related and diversity-linked data, as well as mass scientific firings—have become alarmingly de rigueur. Meanwhile, programmes like the US AI Safety Institute (AISI) were all but gutted—think hundreds of roles cut, especially those tied to “guardrails” setting the tone for responsible AI.

Mounting CVE tsunami meets bureaucratic snail pace

If there was ever a classic case of being overwhelmed by one’s own success—or failure, in this case—the NVD provides it. CVE submissions surged by about 32 per cent in 2024, only sharpening the contrast between blame-worthy growth and severely diminished processing capacity. Security researchers have been raising alarms. One open letter noted that only 4,355 of over 10,000 CVEs had been processed—with a mere 245 handled since March 2024. This is not just a lag; it is a breakdown widely seen as threatening national cybersecurity.

A reluctant sparrow tries to pick up the slack

Enter CISA—the Cybersecurity and Infrastructure Security Agency—stepping into the void with its “vulnrichment” initiative. Its analysts are now enriching CVEs with CVSS, CPE, CWE and Known-Exploited-Vulnerability data. About 1,300 CVEs have already seen the benefit, thanks to this half-burnt, hero-in-the-making programme

The bigger picture

Seen in total, this is not about one man’s whim. It is a structural meltdown: underfunding, deprioritisation of collaborative science, ideological disdain for anything “not sexy,” combined with a perfectly timed explosion in vulnerabilities. The NVD is a plumbing system for cybersecurity; nobody notices until it backs up.

A playbook for survival in the post-NVD era

The decline of the NVD is not some abstract policy debate. It is an operational hazard. With enrichment stalled, backlogs ballooning, and political winds blowing towards anything other than dull public infrastructure, organisations need to stop treating the NVD as a lifeline. Below is a survival playbook for those unwilling to bet their security on bureaucratic resurrection.

Diversify your intelligence diet

Depending solely on the NVD today is like trying to eat on nothing but plain crackers. Supplement it with vendor advisories, exploit feeds, and sector-based information sharing groups. Vendors like Red Hat, Microsoft, and Cisco routinely provide more timely and usable advisories than the NVD. For those with a budget, commercial services such as VulnDB, Risk Based Security, and Qualys fill the enrichment gap. For those without, community-driven feeds, mailing lists, and even curated GitHub repos provide at least partial relief.

Automate triage at the edge

Waiting for enriched metadata is a fool’s errand. Build your own enrichment pipelines that link CVEs to your software inventory, asset database, and threat intelligence. Open-source tools like vulners, grype, and trivy can ingest raw CVE data and perform their own classification. Custom scripts that cross-reference CVEs with your installed packages or SBOMs (Software Bills of Materials) will not be as polished as NVD enrichment, but they give you actionable context. Think of it as rolling your own plumbing when the water company has forgotten how pipes work.

Leverage reproducible builds and binary analysis

Attackers exploit the gap between declared vulnerabilities and what actually runs on your systems. Defenders can close that gap by analysing binaries directly. Tools such as Ghidra, BinDiff, or commercial platforms like ReversingLabs can detect vulnerable code signatures without waiting for a CVE to be neatly tagged. Reproducible builds add another layer of defence, letting teams verify that what they are running matches what upstream vendors intended—no mystery dependencies.

Participate in peer networks

Cybersecurity has always been a team sport, and when central infrastructure fails, the importance of lateral sharing increases. Sectoral ISACs (Information Sharing and Analysis Centers) remain valuable, but informal peer groups, industry Slack channels, and trust networks are often faster. Think of it as moving from a centralised library to a bazaar where information is traded more chaotically but far more quickly. Ah, we are at the bazaar again. One is reminded of the early reuse hype.

Advocate loudly and unapologetically

The failure of the NVD is not just a technical glitch; it is a policy choice. If defenders want reliable infrastructure, they must pressure lawmakers, agencies, and industry bodies to treat vulnerability management as critical infrastructure. That means showing up to consultations, submitting testimony, and making noise in forums that policymakers cannot ignore. Silence has already delivered us the backlog. Outrage might at least slow the decline.

Build resilience into your playbook

Above all, assume the NVD will not recover quickly. Design processes that can withstand permanent degradation of centralised vulnerability services. Bake redundancy into your intelligence pipelines, keep manual triage capacity alive, and cultivate a culture that does not confuse “official” with “useful.” The goal is to survive in an ecosystem where metadata, once a given, has become a luxury.