Loading story…
Security leaders and practitioners are re-evaluating traditional vulnerability management practices as the volume and complexity of threats outpace the capabilities of legacy systems. The near-shutdown of the CVE program highlighted the risks of relying solely on public vulnerability disclosures, as many real-world threats stem from misconfigurations and exposures not tracked by CVEs. Industry experts emphasize the need for a unified, risk-based approach that prioritizes exposures most likely to impact business operations, rather than attempting to address every alert or vulnerability. Continuous Threat Exposure Management (CTEM) and similar frameworks are gaining traction, focusing on validating and prioritizing the handful of exposures that truly matter to organizational resilience.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-14, the White House launched the Gold Eagle initiative to use frontier AI to identify, prioritize, and coordinate remediation of software vulnerabilities across government and critical infrastructure. The move signaled a new U.S. policy response to the scale and speed of modern vulnerability discovery and exploitation.
Infosecurity Magazine reported that ENISA was seeking top-level or root status in the CVE Program, signaling a concrete European bid for a formal governance role in vulnerability identifier management. The move went beyond general expressions of support and reflected an institutional effort to shape the program's future structure.
NIST announced it will prioritize analysis and enrichment for CVEs tied to CISA’s Known Exploited Vulnerabilities catalog, federal government software, and critical software under Executive Order 14028. Other CVEs will still be listed in the National Vulnerability Database but may no longer receive automatic enrichment, reflecting ongoing backlog and workload strain.
A senior European official said the EU wants to help support the CVE Program, signaling international backing for the vulnerability identification system amid ongoing governance and sustainability concerns. The statement marked a new policy development in the debate over how to maintain core vulnerability-tracking infrastructure.
On 2026-02-11, FIRST released its 2026 Vulnerability Forecast, projecting a median of about 59,427 new CVEs and indicating 2026 would likely be the first year to exceed 50,000 published CVEs. The report highlighted scaling challenges for defenders and the vulnerability-tracking ecosystem, with quarterly updates planned to refine the forecast.
Initial story creation
In July 2025, Alexandre Dulaunoy of CIRCL introduced GCVE.eu as a Global CVE Allocation System designed to complement the CVE Program with decentralized identifier allocation and publication. The framework proposed globally unique prefixes for GCVE Numbering Authorities, cryptographic verification, and interoperability with systems such as CVE, GHSA, and EUVD.
On 2025-04-16, CISA/DHS executed an 11-month contract extension to prevent a lapse in support for the CVE Program after concerns that the contract had not been renewed in time. The action temporarily preserved continuity for the vulnerability identification and tracking system amid uncertainty over the program's future.
On 2024-05-24, reporting indicated that the National Vulnerability Database backlog of unanalyzed vulnerabilities was increasing amid funding and resource constraints. The development highlighted mounting strain in the U.S. government's vulnerability-tracking pipeline well before NIST's later decision to narrow enrichment priorities.
LWN published a report describing a significant turning point for the CVE numbering system, indicating emerging disruption or governance changes in how vulnerability identifiers were being managed. This represents an earlier milestone in the story's evolution before GCVE.eu and later NVD policy changes.
LWN reported on efforts to introduce '!CVE' identifiers as a way to supplement the traditional CVE system, reflecting early experimentation with alternative vulnerability identification approaches. The report marked an early milestone in concerns about CVE scalability and governance that later fed into broader changes and new identifier initiatives.
29 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecsoonline.com
Open sourcescworld.com
Open sourcepraetorian.com
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourcelwn.net
Open sourcegcve.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are facing an overwhelming volume of software vulnerabilities, with over 40,000 new CVEs published in 2024 alone, making traditional vulnerability management approaches unsustainable. This has led to a shift toward exposure management, which focuses on reducing the active attack surface rather than simply closing vulnerability tickets. Exposure management platforms, such as Spektion, employ advanced techniques like behavioral monitoring and pre-CVE detection to identify and prioritize risks based on real-world exploitability, including the discovery of shadow IT and actively loaded vulnerabilities. To support effective prioritization, the Common Vulnerability Scoring System (CVSS) provides a standardized framework for assessing and communicating the severity of vulnerabilities. The latest version, CVSS v4.0, introduces expanded metric groups and more granular scoring, enabling organizations to better compare vulnerabilities, prioritize mitigation efforts, and communicate risk to stakeholders. Together, these developments in exposure management platforms and vulnerability scoring systems are helping security teams move beyond the "CVE treadmill" and focus resources on the most critical threats.
Jun 29, 2026
Organizations are increasingly recognizing that simply investing in cybersecurity technologies such as firewalls, SIEMs, and endpoint detection and response (EDR) platforms does not guarantee effective protection against cyber threats. Despite significant expenditures on these tools, attackers continue to exploit misconfigurations, untested rules, and hidden dependencies that evade even the most advanced security environments. A major challenge lies in the misplaced confidence that security teams place in their technology stack, often assuming that controls are functioning as intended without continuous validation. This lack of ongoing assessment can result in underutilized investments, unnoticed security gaps, and operational inefficiencies, ultimately eroding the return on investment (ROI) of security programs. Many organizations focus on the costs and budget allocations of their cybersecurity tools but rarely measure whether these investments are actually effective at the point of need. For example, a next-generation firewall may be capable of blocking advanced threats, but improper configuration can leave critical blind spots. Similarly, endpoint protection platforms may fail to trigger detections during real attacks due to internal telemetry gaps. To address these issues, the cybersecurity industry is witnessing a shift from traditional, periodic vulnerability management (VM) to Continuous Threat Exposure Management (CTEM). CTEM, a term popularized by Gartner, emphasizes the need for continuous, proactive, and automated assessment, prioritization, validation, and remediation of exposures across an organization’s entire attack surface. Unlike traditional VM, which is often reactive and manual, CTEM leverages vulnerability and threat intelligence, attack simulation, and threat validation to provide comprehensive visibility and optimize risk prioritization and remediation. This evolution aims to help organizations coherently understand and manage risk across diverse environments, including endpoints, cloud, SaaS, and code repositories. The adoption of CTEM is driven by the need to address growing vulnerability backlogs, capacity and reliability issues with vulnerability databases, and the demand for actionable, business-aligned risk management. By continuously validating security controls and exposures, organizations can ensure that their investments are delivering measurable protection and are aligned with business outcomes. This approach also helps security teams move away from a perpetual search for new tools and instead focus on optimizing and validating the effectiveness of existing technologies. Ultimately, the integration of continuous validation and CTEM practices is becoming essential for organizations seeking to maximize the ROI of their cybersecurity investments and maintain robust defenses in an increasingly complex threat landscape.
Jun 29, 2026
Organizations are increasingly turning to exposure management and Continuous Threat Exposure Management (CTEM) frameworks to address the challenges of fragmented visibility and risk prioritization in cybersecurity. Security teams often face an overwhelming influx of data from various tools such as vulnerability scanners, identity and access management (IAM) systems, cloud posture platforms, and attack surface monitoring solutions, each providing only a partial view of organizational risk. This fragmented approach can lead to confusion, undermine business confidence, and make it difficult for CISOs to demonstrate measurable risk reduction to boards and regulators. CTEM was developed as a structured, repeatable process to unify discovery, prioritization, validation, and mobilization, aiming to bridge the gap between technical insights and business impact. However, many organizations struggle to move beyond the conceptual stage of CTEM, often using it as a diagnostic tool rather than a means to drive actionable risk reduction. This can create a false sense of progress, where dashboards and reports abound but real security improvements lag behind. Case studies from companies such as Drogaria Araujo, Tenable, and Verizon illustrate the tangible benefits of implementing exposure management platforms. Drogaria Araujo, for example, leveraged exposure management to enhance attack surface visibility and provide the CISO with the necessary context to report on high-risk exposures and demonstrate compliance with Brazil’s General Data Protection Law (LGPD). Before adopting exposure management, Drogaria Araujo’s security efforts were hampered by noisy vulnerability assessments that failed to integrate findings from cloud, identity, or operational technology (OT) systems, resulting in an unmanageable volume of remediation tickets. By unifying siloed data and prioritizing risks that create attack paths to critical assets, these organizations were able to improve their security posture and compliance outcomes. The exposure management maturity model, which includes stages from Ad Hoc to Optimized, provides a roadmap for organizations to advance their cybersecurity programs. Implementing exposure management principles is seen as a crucial step for organizations seeking to mitigate cyber threats effectively. Despite the promise of CTEM and exposure management, the execution gap remains a significant challenge, with many organizations still working to translate conceptual frameworks into deliverable, measurable security outcomes. The experiences of these companies highlight the importance of moving beyond diagnostics to actionable risk reduction, ensuring that security investments lead to real improvements in organizational resilience. As regulatory scrutiny increases and attackers become more sophisticated, the ability to connect visibility to measurable outcomes is essential for maintaining business confidence and reducing liability. The integration of exposure management platforms can help organizations overcome the limitations of fragmented security tools, providing a holistic view of risk and enabling more effective prioritization and remediation. Ultimately, the shift from conceptual frameworks to deliverable solutions is critical for organizations aiming to stay ahead of evolving cyber threats and regulatory demands.
Jun 29, 2026