NIST to stop rating non-priority flaws due to volume increase

NIST will stop assigning severity scores and other enrichment details for lower-priority vulnerabilities starting April 15, limiting full analysis to CVEs tied to CISA KEV, U.S. federal government software, or critical software under Executive Order 14028. The change reflects a 263% surge in submissions, with NIST saying it enriched 42,000 CVEs in 2025 but can no longer keep pace. All CVEs will still be listed in the NVD, but lower-priority items will be marked 'Not Scheduled,' which could slow vulnerability triage and risk assessment for security teams.

Analysis

This is less a one-off process tweak than a structural degradation in the quality of the cyber risk dataset that underpins vendor scoring, procurement gates, and automated controls. The immediate beneficiaries are the biggest cloud/SIEM/ASM platforms and any vendor whose security posture is already strong enough that customers rely on first-party and commercial telemetry instead of the NVD layer; the losers are smaller software names with large long-tail vulnerability surfaces, because they lose the “free” independent normalization that often helps triage and communicate risk. Over the next 1-2 quarters, the second-order effect is a wider dispersion in how quickly enterprise buyers interpret new CVEs, which can slow patching in the middle market and increase demand for paid enrichment, exposure management, and continuous validation tools.

For CNA, the direct financial impact is likely negligible, but for CVE the issue is reputational and procedural rather than immediate revenue-bearing. The more important market implication is that the NVD becomes less useful as a universal clearinghouse, which raises the value of private-sector data aggregation and creates a quality gap between firms that can ingest raw CVEs at scale and those still reliant on public enrichment. That usually shows up with a lag: first in procurement delays, then in higher attach rates for managed detection/response and external attack-surface monitoring, and finally in budget shifts away from “compliance-only” tools toward exploitability-centric workflows.

The contrarian view is that this may be bullish for the cybersecurity ecosystem overall because scarcity of authoritative enrichment forces customers to buy more tooling, not less. The near-term negative headline masks a potential revenue accelerator for vendors that can prove which issues are actually exploitable in a specific environment; the key risk is that enterprises may temporarily underreact to non-prioritized CVEs, creating a window for opportunistic attacks over the next 3-6 months. If NIST later broadens its criteria or automates more enrichment via partners, the current bottleneck fades, but that looks unlikely in the next year given submission growth and staffing constraints.

Key Decisions for Investors

• Long CRWD / ZS into the next 1-2 quarters: both should benefit from higher demand for exploitability-based prioritization and exposure management; use any broad cyber weakness to build the position, with a 3-6 month horizon and upside tied to budget reallocation away from basic vulnerability scoring.
• Long PANW vs. short a basket of lower-tier vulnerability-management vendors over 3-6 months: the market will pay more for platforms that combine telemetry, remediation, and validation; risk is that the trade is crowded, so size modestly and use a relative-value structure.
• Buy call spreads in FTNT or CRWD with 3-6 month tenor: this is a lagged procurement story rather than an immediate EPS inflection, so use defined risk and target a re-rating as customers seek higher-fidelity prioritization workflows.
• Avoid relying on pure-play public-data or compliance-centric cyber names for new longs until the market prices in the lower quality of centralized vulnerability enrichment; if already owned, consider reducing on strength because the moat shifts toward proprietary data ingestion, not reporting.