NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions

NIST will now only enrich CVEs that meet priority thresholds, including those in CISA's KEV catalog, federal government software, or critical software under Executive Order 14028; all other CVEs will be marked 'Not Scheduled.' The change follows a 263% surge in CVE submissions from 2020 to 2025, with nearly 42,000 CVEs enriched in 2025 and about 10,000 vulnerabilities from 2025 still lacking a CVSS score. The shift is likely to pressure organizations that rely on NIST as a primary vulnerability-enrichment source, though it is framed as a risk-based operational adjustment rather than a negative industry shock.

Analysis

This is a structural bottleneck, not a one-off process tweak. By explicitly triaging enrichment to exploitability-adjacent categories, NIST is effectively turning the NVD from a broad reference layer into a curated signal feed, which should widen the gap between organizations with their own vuln-intel pipelines and those that outsource prioritization to the database. The immediate beneficiaries are security platforms that can ingest raw CVE firehoses, cluster duplicates, infer severity, and map exposures to asset context; the losers are compliance-driven buyers and smaller MSSPs whose workflows depend on a complete, timely, government-grade score.

Second-order, this should push budgets away from passive scoring and toward continuous exposure management, attack-path analytics, and KEV-driven remediation orchestration. That favors vendors selling endpoint telemetry, asset inventory, and automated prioritization because their value proposition improves when authoritative enrichment becomes sparse and slower. It also raises switching costs for large enterprises that have standardized audit and control frameworks on NVD completeness; over the next 2-4 quarters, expect more internal tooling, more demand for threat intel APIs, and more friction in vendor risk assessments where “unknown” becomes the default state for long-tail CVEs.

The contrarian risk is that this could be less bullish for cybersecurity spend than the market assumes: if NIST’s curated layer becomes the de facto reference, some buyers may conclude they can defer broad vulnerability management and focus only on KEV, compressing usage in lower-end scanners and some data-enrichment workflows. The bigger catalyst would be any rise in high-profile exploit events tied to currently unscheduled CVEs, which would force NIST to expand backlog handling and validate the need for broader enrichment. Watch for a 1-3 month lag in customer behavior: procurement changes will be slower than the operational scramble, but budget reallocation could hit within the next planning cycle.

Key Decisions for Investors

• Long PANW / short a legacy vulnerability-scanner or compliance-heavy security vendor basket for 3-6 months: PANW should benefit from demand for exposure-aware workflows, while legacy scoring-dependent tools face workflow disruption and weaker narrative leverage.
• Buy CRWD on pullbacks over the next 2-8 weeks if the market overreacts to 'less data' headlines; the setup is favorable if management positions endpoint telemetry as the new source of truth for prioritization. Target a 10-15% move, stop if customers signal budget delays tied to NVD changes.
• Initiate a pair trade: long ZS / short a small-cap governance/compliance software name exposed to audit workflow friction. The upside is a repricing toward machine-speed risk management; the short leg benefits if enterprise buyers defer spend while reworking processes.
• For options, buy 6-9 month calls on a platform vendor with strong exposure management messaging, funded by selling near-dated upside in lower-quality scanner names. This expresses a transition trade: long the winners of enrichment scarcity, short the firms whose products assumed enrichment abundance.