Vulnerability Monopoly: Is MITRE’s CVE Program Failing Cybersecurity?

In the high-stakes world of cybersecurity, one acronym rules the landscape: CVE. But behind the scenes, a growing chorus of experts is questioning whether the government-backed Common Vulnerabilities and Exposures program-run for decades by MITRE-has become an expensive bottleneck, stifling innovation and dragging its heels while critical bugs slip through the cracks.

The CVE system was conceived as a universal language for identifying security bugs-a noble goal, but critics argue it was hardly the groundbreaking innovation it claimed to be. By the time MITRE published its first 321 CVE records, other databases like ISS X-Force and commercial ventures had already cataloged thousands of vulnerabilities.

How did MITRE come to dominate? As an FFRDC, it enjoys privileged status: government contracts awarded without competition, justified by supposed “novelty” and “special competence.” Yet, cybersecurity veterans point out that CVE was neither novel nor uniquely expert-driven. Even today, the program’s sluggish response-sometimes taking months to assign a CVE ID-has frustrated researchers and left organizations exposed.

The financials are equally eyebrow-raising. MITRE’s CVE funding has ballooned to nearly $30 million annually, costing an estimated $664 for each published vulnerability entry. Meanwhile, community-driven or commercial databases have managed broader coverage at a fraction of the cost. “A superior database can be run for a tiny fraction of that cost,” one industry insider asserts.

Regulatory requirements for FFRDCs demand objectivity, adaptability, and cost-effectiveness. Yet, MITRE’s record is spotty: slow to address emerging threats like SaaS vulnerabilities, and questions linger about its impartiality. According to federal rules, sponsors like CISA must periodically review whether an FFRDC is still necessary or if commercial solutions would serve better. For CVE, that moment may be fast approaching.

As cyber threats outpace bureaucracy, the debate over who should guard the world’s vulnerability database is heating up. Is it time for the private sector to take the reins, or does the public interest demand a federal hand? One thing is clear: the status quo is costing more than just money.

WIKICROOK

• CVE: CVE, or Common Vulnerabilities and Exposures, is a system for uniquely identifying and tracking publicly known cybersecurity flaws in software and hardware.
• FFRDC: An FFRDC is a government-sponsored organization that conducts impartial research and development for national interests, including cybersecurity and technology.
• Vulnerability Database (VDB): A vulnerability database catalogs and tracks software security flaws, providing details to help organizations manage and mitigate cybersecurity risks effectively.
• CISA: CISA is the U.S. agency that protects critical infrastructure and digital systems from cyber threats and other security risks.
• SaaS: SaaS is software accessed online via subscription, not installed locally. It offers convenience but introduces specific cybersecurity considerations.