SECAI Core · phase 14 of 15
NIST National Vulnerability Database (NVD)
A US government-maintained, publicly accessible repository of standardized information about known cybersecurity vulnerabilities, built on the MITRE CVE list and enriched with severity scores, impact metrics, and other security data to help organizations assess and manage vulnerability risk
The Explain card
- Plain English
- The NVD is a US government repository that takes the MITRE CVE list and enriches each entry with severity scores, impact metrics and other structured data so organisations can assess and prioritise vulnerability risk.
- Example
- An AI platform team has thirty CVEs across their dependencies. Using NVD severity scores, they patch the critical remote code execution flaw in their model-serving framework first and schedule the low-severity issues for later.
- Why it matters
- Knowing a vulnerability exists is step one. NVD tells you how bad it is, which is what risk-based patching of AI infrastructure depends on.
- Hook
- CVE names the bug, NVD grades it.
Where it sits in the deck
Phase 14: Incident Response, Evaluation, and Knowledge Bases
When detection fires, teams need structured response plans, scoring frameworks, and curated knowledge bases to triage, measure, and learn from AI security events.
