Comments to NIST Regarding Modernizing the National Vulnerability Database in the Age of AI

ITIF has submitted comments to NIST on the modernization of the National Vulnerability Database, according to the organization's publication titled 'Comments to NIST Regarding Modernizing the National Vulnerability Database in the Age of AI.' The comments are addressed to NIST, and they concern the National Vulnerability Database, referred to in the submission as the NVD. The title frames the subject as a question of modernizing the database in the age of AI.

In the comments, ITIF notes that the Department of Commerce Inspector General found that the NVD backlog could more than double within 2026. ITIF further states that frontier AI systems are already capable of identifying and chaining vulnerabilities faster than existing validation and enrichment processes can absorb. The two points are presented together: a projected increase in the backlog, and a rate of vulnerability identification and chaining that the existing validation and enrichment processes cannot keep up with. The submission does not give a figure for the current backlog beyond the projection that it could more than double within 2026.

The submission places the National Vulnerability Database's modernization in relation to frontier AI capability, in the specific sense of identifying vulnerabilities and chaining them. The backlog projection is attributed to the Department of Commerce Inspector General. The capability described is attributed to frontier AI systems, and the constraint described is the capacity of existing validation and enrichment processes to absorb what those systems produce. ITIF's comments are directed to NIST.