CVEs lose relevance: Get proactive — and think beyond vulnerabilities

The report examines how NIST’s pause in NVD CVE enrichment in 2024 created a backlog and shifted enrichment to CNAs, prompting CISA’s “Vulnrichment” program to mitigate gaps, with data showing steep declines in NVD-enriched CVEs for npm and PyPI and estimates that most new vulnerabilities went unanalyzed. It concludes that vulnerability-centric, reactive approaches (including EPSS-based prioritization) are insufficient and urges organizations to adopt proactive software supply chain security, emphasizing binary analysis, reproducible builds, and detection of tampering, malware, and secrets exposure.