RadicalNotion.AILast reviewed
Vulnrichment is CISA's vulnerability enrichment program. CISA acts as an Authorized Data Publisher (ADP) in the CVE Program, which means it adds data to existing CVE records without assigning the IDs. Vulnrichment attaches SSVC decision points, CVSS scores, CWE weakness mappings, and CPE product identifiers to published CVEs, helping defenders triage flaws that the original CNA left without that enrichment.
Vulnrichment is the name of CISA's program for enriching CVE records with the extra data defenders need to prioritize. CISA runs it in its role as an Authorized Data Publisher (ADP) within the CVE Program, a role that adds data to records but never assigns CVE IDs.
It exists because many CVE records, especially when first published by a CNA, lack the severity, weakness, and product details needed to triage them. Rather than waiting on a single downstream database, CISA enriches records directly inside the CVE data itself.
Vulnrichment writes its data into a separate ADP container attached to the CVE record, so the original CNA's content stays intact. The enrichment focuses on the signals that drive prioritization.
In the CVE Program, CNAs assign CVE IDs and write the base record, while an ADP enriches records that already exist. CISA, one of the two Top-Level Roots in the program, uses the ADP mechanism for Vulnrichment. Because the enrichment lives in its own container alongside the CNA's data, consumers can clearly see which fields came from the CNA and which came from CISA.
This is different from the National Vulnerability Database, which historically performed similar enrichment as a separate downstream database. Vulnrichment puts comparable data directly into the CVE record, so tools that read the CVE feed get the enrichment without a second source.
Vulnrichment grew in importance as NVD enrichment slowed and a large backlog of CVEs went unanalyzed. By prioritizing recent and likely-relevant CVEs and attaching SSVC, CVSS, CWE, and CPE data, CISA gives defenders a triage-ready record straight from the authoritative CVE feed.
For prioritization, the SSVC decision points are the standout addition: they encode exploitation and impact judgments that map directly onto a remediation decision, complementing the CVSS and EPSS signals teams already use.