NVD delays highlight vulnerability management woes: Put malware first

The report analyzes NIST’s abrupt reduction in NVD metadata analysis (CWE/CPE/CVSS), the backlog it created, and how it disrupts enterprise vulnerability management and compliance, especially for FedRAMP-bound organizations. It highlights community responses (industry consortium, open-source data supplements), critiques reliance on CVSS in favor of EPSS, and urges a shift beyond reactive patching toward proactive measures like threat hunting, binary validation, and supply chain tamper detection to address modern software risks.