Best Talks at CVE/FIRST VulnCon 2026 & Annual CNA Summit

Hand-picked from in-depth reviewer verdicts — the top 12 talks from this conference. Skip the noise, find the signal.

← All talks at CVE/FIRST VulnCon 2026 & Annual CNA Summit

1

Lessons From NPM's Dark Side: Preventing the Next Shai-Hulud

Jenn Gile

In this compelling talk at VulnCon, Jenn Gile, co-founder of opensourcemalware.com, illuminated the escalating threat of intentionally malicious packages within the Node Package Manager (NPM) ecosystem. Titled "Lessons From NPM's Dark Side: Preventing the Next Shai-Hulud," the…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
2

Mind the Match: Why Vulnerability Matching Is Harder Than You Think

Alexandra Selldorff

In her VulnCon talk, "Mind the Match: Why Vulnerability Matching Is Harder Than You Think," Alexandra Selldorff of Manifest Cyber dissects the often-overlooked complexities and inherent challenges within the automated process of vulnerability matching. Selldorff argues that the…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
3

How to Answer “What’s Affected?” in Open Source

Jess Lowe, Rex Pan

In an era of exponentially increasing software vulnerabilities, accurately identifying "what's affected" in open-source projects has become a critical, yet often elusive, challenge. Jess Lowe and Rex Pan, software engineers on the Google Open Source Security team, presented a…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
4

A Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle

Art Manion, Jay Jacobs

In this thought-provoking talk at VulnCon, Art Manion and Jay Jacobs present a radical re-evaluation of how the cybersecurity industry approaches vulnerability identification and management. They contend that the existing frameworks, including prominent ones like CVE and NVD…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
5

CVE Decaf: Brewing Better and More Actionable Data Quality

Jerry Gamblin, Jay Jacobs

In "CVE Decaf: Brewing Better and More Actionable Data Quality," Jerry Gamblin from Cisco and Jay Jacobs from Empirical Security address a critical and growing challenge facing the cybersecurity community: the insufficient quality and usability of Common Vulnerabilities and…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
6

The Myth of the Meteoric Rise in Vulnerabilities

Scott Moore

In his compelling VulnCon talk, "The Myth of the Meteoric Rise in Vulnerabilities," Scott Moore of VulnCheck challenges the prevailing narrative that the number of security vulnerabilities is skyrocketing uncontrollably. While acknowledging that the raw count of Common…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
7

AI Systems Are Software Systems

Jonathan Spring

In an era saturated with discussions about artificial intelligence, Jonathan Spring of CISA (Cybersecurity and Infrastructure Security Agency) delivered a pivotal talk at VulnCon titled "AI Systems Are Software Systems." Spring's central thesis is both straightforward and…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
8

The Quality Era of CVE: A Blueprint for Global Software Safety

Bob Lord

In his compelling VulnCon talk, "The Quality Era of CVE: A Blueprint for Global Software Safety," Bob Lord challenges the cybersecurity community to fundamentally rethink the Common Vulnerabilities and Exposures (CVE) program. Lord invites the audience to imagine a world where…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
9

Quantifying Swiss Cheese, the Bayesian Way

Stephen Shaffer

Stephen Shaffer, an engineer at Moderna and co-chair of the EPSS Special Interest Group, presented a compelling and ambitious vision for a **quantified vulnerability risk model** in his VulnCon talk, "Quantifying Swiss Cheese, the Bayesian Way." Shaffer tackles a fundamental…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
10

The Weaponization Gap: What 20 Million KEV Detections Reveal About Edge Remediation

Saeed Abbasi

This VulnCon talk, "The Weaponization Gap: What 20 Million KEV Detections Reveal About Edge Remediation," delivered by Saeed Abbasi, Senior Manager of Security Research at Qualys Threat Research Unit (TRU), delves into the critical and often overlooked challenges of securing…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
11

The CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet

Kota Kanbe, Ryunosuke Tanai

In an era of increasing software supply chain attacks, traditional vulnerability management approaches often fall short. This talk, delivered by Ryunosuke Tanai and Kota Kanbe of Future Corporation, Japan, exposes a critical "CVE blind spot" that leaves organizations vulnerable…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
12

NIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem

Harold Booth

Harold Booth from the National Institute of Standards and Technology (NIST) delivered a critical update on the state of the **National Vulnerability Database (NVD)** and its evolving role within the broader vulnerability enrichment ecosystem. The talk addressed the escalating…

0 Dr. Zero SOLID ★★★☆☆ H Heather Calloway STRONG ACCEPT ★★★★☆