As reported by BleepingComputer, AI-driven vulnerability discovery is colliding with an enrichment infrastructure that was never designed for this volume. The result is a structural breakdown — not a temporary backlog — that fundamentally changes how defenders must operate.
The Enrichment Gap Is Now a Threat Vector
The most consequential detail in this story isn't the 92% year-over-year increase in disclosed vulnerabilities. It's NIST's quiet reclassification of approximately 30,000 CVEs published before March 1, 2026 as "Not Scheduled" for enrichment. That decision transforms a metadata problem into an operational security risk.
Here's why this matters more than it appears: NVD enrichment — CVSS scoring, CPE mapping, affected-version enumeration — is the scaffolding that makes vulnerability data machine-actionable. When security tools ingest a CVE identifier, they're typically relying on that structured metadata to determine whether the flaw applies to a specific asset, whether it's remotely exploitable, and what the remediation path looks like. Without enrichment, a CVE is little more than a string. Many automated patch management and vulnerability scanning platforms will deprioritize or silently skip unenriched entries, creating blind spots that attackers can exploit.
The asymmetry is stark: attackers are already correlating vendor advisories, GitHub commits, exploit PoCs, and dark web discussions in real time. Defenders waiting for NVD enrichment are operating on a delay cycle measured in weeks or months.
Why AI Makes This Worse, Not Better
AI-assisted fuzzing, LLM-guided code analysis, and automated vulnerability research tools are dramatically expanding the discovery pipeline. Action1's report cites a 128% increase in RCE-enabling vulnerabilities alone. But the remediation pipeline — patching, testing, deployment — has not accelerated at a comparable rate. This creates a widening interval between disclosure and remediation that threat actors are actively exploiting.
The uncomfortable truth is that AI benefits attackers more than defenders in this equation. An attacker needs only one unpatched, unenriched vulnerability to compromise an environment. A defender needs complete, enriched, prioritized data across the entire estate.
Who Is Most Exposed
Shield53 Recommendations
Defenders can no longer treat NVD as the single source of truth for vulnerability intelligence. The enrichment gap requires a multi-source correlation strategy:
- Supplement NVD with vendor-published advisories directly. Subscribe to vendor security mailing lists and RSS feeds for your critical software stack. Vendor advisories often publish before NVD enrichment and contain patch information.
- Integrate alternative enrichment sources. Feed your vulnerability management platform with data from sources like GitHub Security Advisories (GHSA), Exploit-DB, and commercial threat intelligence feeds that don't depend on NVD processing cycles.
- Audit your scanner's handling of unenriched CVEs. Determine whether your vulnerability management tool silently deprioritizes or filters out CVEs lacking NVD metadata. This is a common blind spot.
- Build an internal enrichment capability. For critical assets, develop a lightweight process to manually assess unenriched CVEs using vendor changelogs, commit history, and researcher disclosures. Don't wait for NIST.
- Adopt risk-based patch prioritization independent of CVSS. Factor in exploit availability, asset exposure, and business context. A "Not Scheduled" CVE with a public PoC is a higher priority than an enriched CVE with no known exploit path.
- Monitor the CISA Known Exploited Vulnerabilities catalog as a complementary signal — it often surfaces actionable threats before full NVD processing completes.
The era of waiting for centralized enrichment is over. Organizations that build resilient, multi-source vulnerability intelligence pipelines will weather this transition. Those that don't will find themselves defending against attackers who are already operating inside the gap.
