Key Takeaways
- NATO’s Cyber Security Centre and the AI‑driven startup AISLE have been accepted as CVE Numbering Authorities (CNAs) under the ENISA Root.
- The expansion brings the total number of CNAs under ENISA to 20, with 12 created by ENISA and eight migrated from the long‑standing MITRE Root.
- ENISA cites the rise of frontier AI models and evolving vulnerability discovery practices as drivers for a more globally representative, resilient, and scalable vulnerability‑identification ecosystem.
- NATO’s new authority will allow it to assign CVE IDs to flaws across its enterprise, improving internal tracking and enabling faster information sharing with trusted partners.
- AISLE’s mandate is narrower: it can issue CVE IDs for vulnerabilities discovered in its own products, supporting coordinated disclosure and reinforcing its commitment to holding its software to the same standards it expects of others.
- The CVE program narrowly avoided a shutdown in April 2025 thanks to an 11‑month contract extension; since then, alternative databases such as Luxembourg’s Global CVE Allocation System (GCVE) have emerged to diversify vulnerability tracking.
- Both NATO and AISLE highlight the importance of internal vulnerability management as a foundation for broader community coordination.
- The changes reflect ongoing efforts to strengthen the global vulnerability‑identification infrastructure amid an accelerating flow of AI‑generated flaw discoveries.
Overview of the Recent ENISA Root Expansion
The European Union Agency for Cybersecurity (ENISA) announced last week that two new entities have joined its CVE Numbering Authority (CNA) roster: NATO’s Cyber Security Centre, part of the NATO Communications and Information Agency, and AISLE, a cybersecurity startup with offices in San Francisco and Prague. By accepting these organizations, ENISA now oversees 20 CNAs operating under its Root—12 created directly by ENISA and eight transferred from the MITRE Root, which has administered the CVE program for more than two decades. This shift underscores ENISA’s growing role as a central hub for vulnerability identification in Europe and beyond.
Why ENISA Is Expanding the CNA Network
Hans de Vries, ENISA’s chief cybersecurity and operations officer, linked the expansion to recent shifts in the global cybersecurity landscape. He pointed out that the emergence of frontier AI models has transformed how vulnerabilities are discovered and exploited, increasing both the volume and speed of flaw reporting. In a statement, de Vries argued that building a “more globally representative, resilient, and scalable vulnerability identification ecosystem” is essential to keep pace with these developments. The addition of NATO and AISLE exemplifies ENISA’s strategy to diversify the sources of CVE assignments while maintaining consistency and reliability.
NATO Cyber Security Centre’s New CVE Authority
The NATO Cyber Security Centre can now assign CVE identifiers to eligible security flaws discovered across the NATO enterprise. According to the alliance, this capability will streamline internal tracking of vulnerabilities and enable NATO to share vulnerability information with trusted partners more swiftly. The centre’s core responsibilities—guarding NATO’s networks, monitoring for threats, and coordinating incident responses—will benefit from having a standardized identifier system that aligns with the broader cybersecurity community. By issuing its own CVE IDs, NATO reduces reliance on external intermediaries and accelerates the disclosure‑to‑patch cycle for its own systems.
AISLE’s Focused CVE Mandate
Unlike NATO’s broad mandate, AISLE’s authorization is limited to vulnerabilities found in its own products. In a July press release, the company explained that the designation allows it to publish CVE identifiers immediately after internal discovery, without waiting for a third‑party authority to process a request. Jaya Baloo, AISLE’s co‑founder, described the step as “foundational,” emphasizing that coordinated disclosure begins with holding one’s own products to the same standard expected of others. Apart from this new authority, AISLE’s researchers have already disclosed hundreds of vulnerabilities in widely used open‑source projects such as OpenSSL, Linux, Apache, and OpenEMR, each coordinated through the relevant project‑specific CNA.
The CVE Program’s Recent Turbulence
The CVE program, which assigns a unique record to each publicly disclosed security flaw, has faced significant upheaval in recent months. In April 2025, the program narrowly avoided a sudden shutdown when a last‑minute, 11‑month contract extension was secured, preventing an interruption in the issuance of CVE IDs. Since that close call, several alternative databases have emerged, driven by European nonprofits and private entities seeking to improve coordination around vulnerability tracking, disclosure, and patching. Notably, Luxembourg’s Computer Incident Response Center (CIRCL) launched the Global CVE Allocation System (GCVE) as an alternative to the traditional CVE framework, reflecting a growing appetite for redundancy and choice in the vulnerability‑identification space.
Implications for Global Vulnerability Management
The inclusion of NATO and AISLE under the ENISA Root signals a broader trend toward decentralization and diversification of the CVE ecosystem. By empowering organizations with distinct mandates—such as a multinational alliance’s internal security arm and a product‑focused AI startup—the system can capture vulnerability data from a wider array of sources while maintaining the universal reference point that CVE IDs provide. This diversification helps mitigate single‑point‑of‑failure risks highlighted by the program’s near‑shutdown earlier this year and supports a more resilient pipeline from discovery to remediation.
Looking Ahead: AI, Coordination, and Standards
As frontier AI models continue to accelerate flaw detection, the pressure on vulnerability‑identification infrastructures will only increase. ENISA’s emphasis on building a “strong vulnerability management infrastructure and capabilities” acknowledges that AI‑generated findings may outpace traditional manual processes. The expanded CNA network, coupled with emerging alternatives like GCVE, aims to create a flexible yet standardized environment where governments, vendors, and researchers can reliably reference the same flaw regardless of where it was first discovered. Ultimately, the goal remains to shorten the window between vulnerability disclosure and effective patching, thereby raising the baseline security of digital ecosystems worldwide.