The Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?

The Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?

Speakers: Lisa Olson, Principal Program Manager, Microsoft

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=iCzssRtsh3o

Overview

In an era defined by an ever-accelerating pace of software development and a corresponding surge in discovered vulnerabilities, the traditional mechanisms for managing and communicating security flaws are reaching a critical breaking point. Lisa Olson, a Principal Program Manager at Microsoft with over a decade of experience managing the labyrinthine "Patch Tuesday" release cycle, delivered a compelling talk at VulnCon, illuminating the hidden, astronomical costs associated with CVEs (Common Vulnerabilities and Exposures). Her presentation served as a stark warning about the unsustainable trajectory of vulnerability disclosure and management, particularly in light of emerging factors like AI-driven vulnerability discovery and stringent regulatory frameworks such as the European Union's Cyber Resilience Act (CRA).

Olson's core argument posits that while publishing CVEs is a necessary act for vendors, the downstream burden on the global ecosystem of defenders and consumers is immense and largely unquantified. She highlighted that the process is not "free" for anyone involved—from the researchers who find vulnerabilities, to the vendor teams who fix them, and critically, to the countless organizations worldwide that must assess, test, and deploy patches. The talk explored whether machine-readable standards like CSAF (Common Security Advisory Framework) and VEX (Vulnerability Exploitability eXchange) can introduce much-needed efficiencies, thereby changing the equation and mitigating the impending deluge of vulnerability data.

This article delves into Olson's insights, dissecting the challenges, exploring the potential solutions, and outlining the critical implications for both producers and consumers of vulnerability information. It underscores the urgent need for industry-wide collaboration to evolve the current system from a human-intensive, often inconsistent process into a streamlined, automated, and more effective defense mechanism against an increasingly complex threat landscape.

Background

▶ Watch: Estimated 200 million human hours per Windows CVE (2:00)

The landscape of vulnerability management is rapidly changing, driven by both technological advancements and regulatory pressures. Lisa Olson, speaking from her vantage point at Microsoft's MSRC (Microsoft Security Response Center), painted a vivid picture of this escalating challenge. She noted that even Microsoft, a primary CNA (CVE Numbering Authority) since the inception of the program, doesn't publish CVEs for every vulnerability it fixes, suggesting an already existing internal filter on what becomes public. However, the overall trend is towards greater transparency and a significant increase in CVE volume.

This surge is fueled by several factors. The advent of AI-powered vulnerability discovery promises to uncover flaws at an unprecedented rate, potentially generating thousands of vulnerability reports "in one go," as Olson cautioned. Simultaneously, regulatory bodies are imposing new requirements. The Cyber Resilience Act (CRA), for instance, mandates greater accountability and transparency from software producers, likely leading to more comprehensive and frequent vulnerability disclosures. This regulatory push, combined with technological shifts, creates a perfect storm where the sheer volume of CVEs threatens to overwhelm existing manual processes.

Olson illustrated this with several anecdotes. Google, a major CNA, saw its Chrome CVE publications jump from 174 in all of last year to 186 in just the first three months of the current year, indicating a significant ramp-up. Microsoft's own internal red team is finding vulnerabilities "in bulk," necessitating automated processes for their submission and assessment. The widespread impact of this volume is not limited to large vendors; GitHub, for example, is reportedly "getting overwhelmed with the number of CVEs" it processes, as highlighted in an article by Madison.

The current system, heavily reliant on human interpretation and manual processes, is struggling to keep pace. Olson shared a provocative thought experiment using Copilot, estimating that a single Windows CVE could accrue approximately 200 million estimated global human hours devoted to assessment, testing, and deployment across 10 million organizations worldwide. While acknowledging these numbers might be exaggerated, they powerfully underscore the non-zero and substantial effort required by organizations globally. This colossal expenditure of human capital highlights the urgent need for more efficient, machine-readable approaches to vulnerability data. Microsoft, recognizing this, has been "glomming on to all these standards" over the years, including CBRF and newer initiatives, indicating a shift towards standardized, automated vulnerability communication.

Key Findings

▶ Watch: 100 million reads for Azure Linux VEX statements (9:00)

Lisa Olson's presentation underscored several critical findings regarding the current state and future trajectory of vulnerability management:

1. The Unseen Economic Burden of CVEs: The most striking finding was the estimated global human cost of managing CVEs. Olson's Copilot-assisted calculation suggested that a single Windows CVE could consume an astonishing 200 million human hours globally. This figure, while a high-level estimate, vividly illustrates the immense, often unquantified, labor expended by organizations worldwide in responding to vulnerability disclosures. This "hidden cost" highlights the profound inefficiency of the current, largely manual system.

1. VEX Demonstrates Significant Adoption and Potential: Despite the nascent stage of machine-readable vulnerability data, Microsoft's experience with VEX (Vulnerability Exploitability eXchange) for Azure Linux is highly promising. Olson reported over 100 million requests for Azure Linux VEX statements in the month of March alone, with daily requests often reaching into the millions. This substantial traffic indicates that organizations are actively consuming VEX data, suggesting a tangible benefit and a strong appetite for machine-readable information that clarifies product-vulnerability relationships. This early success offers a glimpse into how VEX can streamline vulnerability assessment by explicitly stating whether a product is affected or unaffected by a given CVE.

1. Inconsistent Quality and Lopsided Production of CVEs: The quality and completeness of CVE records vary significantly across the ecosystem. Olson pointed out that 80% of CVE records are created by a small fraction of CNAs, leading to a heavily skewed distribution. Even among the top 20 producers, achieving 100% enrichment (e.g., complete CVSS scores, accurate CWEs, and CPEs) remains a challenge. Smaller CNAs, which produce fewer records, face even greater difficulties in accurately scoring and categorizing vulnerabilities due to lack of practice and automation. This inconsistency undermines the utility of CVEs for automated consumption and reliable prioritization.

1. Industry-Driven Tooling is Critical: Olson argued that the industry cannot solely rely on regulators or organizations like MITRE to build the necessary tools for efficient CVE management. She emphasized that those "doing this on the daily basis" – the vendors and security teams – are best positioned to develop solutions that meet real-world needs. There's an urgent call for industry collaboration to create a "CVE machine" that can seamlessly generate standardized, high-quality CSAF (Common Security Advisory Framework) and VEX data, complete with accurate scores and enumerations.

1. Risk of CVE Ecosystem Fragmentation: The proliferation of new, regionally specific vulnerability numbering systems (e.g., EUVD, GCV) driven by regulations like the CRA poses a significant threat. Olson stressed the importance of preserving the 26-year legacy of the CVE program and integrating these new systems rather than allowing them to splinter off. Fragmentation would force defenders to correlate disparate data sources, reintroducing the very inefficiencies that machine-readable standards aim to solve.

Technical Deep Dive

▶ Watch: Challenges for CNAs in creating quality CVEs (10:30)

The core of Lisa Olson's talk revolved around the technical standards and processes that define modern vulnerability management, and the urgent need for their evolution.

At the heart of the discussion are CVEs (Common Vulnerabilities and Exposures), which serve as the foundational identifiers for publicly known cybersecurity vulnerabilities. However, a CVE ID alone provides minimal context. To make CVEs actionable and machine-readable, they must be enriched with additional data points and delivered through standardized formats.

Key to this enrichment are:

• CVSS (Common Vulnerability Scoring System): A standardized method for rating the severity of a vulnerability. Olson highlighted the difficulty, especially for less experienced CNAs, in accurately assigning CVSS scores, noting it "takes practice to get good at this." This human element introduces inconsistency and reduces the reliability of automated severity-based prioritization.
• CWE (Common Weakness Enumeration): A community-developed list of common software and hardware weakness types. Olson acknowledged the challenge of selecting appropriate CWEs, stating that "CWE is mysterious in its own way and we struggle sometimes because there's so many CWEs and many of them you know, they don't fit necessarily." This complexity impacts the quality of vulnerability classification.
• CPE (Common Platform Enumeration): A standardized naming scheme for software, hardware, and operating systems. Proper CPE usage is crucial for identifying affected products, yet its consistent application is also a challenge.

The proposed solution lies in adopting and consistently implementing machine-readable standards like CSAF (Common Security Advisory Framework) and VEX (Vulnerability Exploitability eXchange).

• CSAF is an OASIS standard designed to create machine-readable security advisories. It provides a flexible framework for communicating vulnerability information, including details about affected products, remediation steps, and importantly, VEX statements. The vision is for a "CVE machine" that "spits out in proper CSAF" with all the necessary enrichment.
• VEX is a specific profile or component often implemented within CSAF. A VEX statement explicitly communicates whether a product is affected, unaffected, fixed, or under investigation regarding a known vulnerability (CVE). This is a game-changer because it allows consumers of vulnerability data to quickly filter out irrelevant CVEs. Instead of every organization having to independently assess the impact of every CVE on their specific product stack, they can rely on vendor-provided VEX statements. Microsoft's experience with Azure Linux VEX, seeing over 100 million requests in March, strongly indicates its practical value and high demand.

Olson also touched upon the technical challenges faced by CNAs. Microsoft, despite its scale, uses tools like Jerry Gamblin's CNA Scoreboard to monitor its CVE completeness and quality, striving for 100% on metrics like CWE inclusion. This highlights that even large organizations require external validation and continuous effort to maintain high standards. The talk also revealed Microsoft's efforts to automate the creation of CVEs for Chrome, given that Edge is "95% Chrome." This involves taking Google's CVEs and republishing them with Microsoft-specific context, a process that requires significant automation to handle the volume. Similarly, Microsoft's internal red team is now finding vulnerabilities "in bulk," necessitating automated workflows for submission and assessment.

Looking ahead, Olson warned about the potential impact of LLM (Large Language Model) technology in vulnerability discovery, which could "spit out 5,000 vulnerabilities in one go." This prospect underscores the need for highly automated, machine-readable systems capable of processing and contextualizing such an immense volume of data, preventing the industry from being overwhelmed. The technical goal is to move towards a world where all parties "spoke the same language" and vulnerability data flowed "seamlessly across the companies."

Demo / Proof of Concept

▶ Watch: Industry needs to build its own CVE tooling (12:30)

Lisa Olson's talk was primarily an analytical and conceptual discussion on the challenges and potential solutions in vulnerability management, rather than a demonstration of a specific tool or proof of concept. There was no live demo or technical walkthrough of software during the presentation.

However, the talk presented compelling real-world evidence of the utility and adoption of VEX (Vulnerability Exploitability eXchange), which serves as a powerful testament to its practical application. Microsoft is actively publishing VEX statements for Azure Linux, a significant product within their ecosystem. Olson presented data showing that these VEX statements garnered over 100 million requests in the month of March alone, with daily requests often exceeding a million. This widespread consumption of VEX data, even for a single product, functions as a de facto "proof of concept" demonstrating that machine-readable vulnerability information is being actively utilized by the industry and is proving valuable in practice. This indicates that the underlying technical standards (like CSAF, which VEX often leverages) are indeed capable of delivering actionable intelligence at scale.

Defensive Implications

▶ Watch: Avoiding splintering of the core CVE system (15:00)

The insights shared by Lisa Olson have profound defensive implications for organizations of all sizes, highlighting both the current inefficiencies and the path towards a more resilient future.

Firstly, the estimated 200 million human hours spent globally on a single Windows CVE underscore the massive drain on defensive resources. Defenders currently dedicate substantial time to:

• Vulnerability Assessment: Sifting through a constant stream of CVEs to determine relevance to their specific software stack.
• Impact Analysis: Manually evaluating the severity (often relying on potentially inconsistent CVSS scores) and potential exploitability of each vulnerability in their environment.
• Testing and Deployment: Thoroughly testing patches before rolling them out to production systems.

This manual, labor-intensive process is unsustainable, especially as CVE volume continues to explode due to factors like AI-driven discovery and regulatory mandates.

The adoption of machine-readable standards like CSAF (Common Security Advisory Framework) and VEX (Vulnerability Exploitability eXchange) offers a critical pathway to alleviate this burden.

• VEX for Prioritization: VEX is a game-changer for defenders. By providing explicit statements from vendors on whether a product is affected, unaffected, or fixed by a given CVE, VEX allows automated systems to instantly filter out irrelevant vulnerabilities. This eliminates countless hours currently spent on manual assessment, enabling security teams to focus their limited resources on truly critical issues. Microsoft's experience with Azure Linux VEX, seeing over 100 million requests, clearly indicates that defenders are already leveraging this information to gain efficiency.
• Automated Data Consumption: CSAF, as a broader framework, enables the automated ingestion and processing of security advisories. This means security tools, vulnerability management platforms, and SIEMs can directly consume and act upon vendor advisories, reducing human error and accelerating response times.

Defenders must also be acutely aware of the inconsistent quality of CVE data. Olson noted that even top CNAs struggle with 100% enrichment (e.g., complete CWEs, accurate CVSS). This means that relying solely on CVEs without deeper analysis or trusted vendor advisories can lead to misprioritization. Tools like Jerry Gamblin's CNA Scoreboard can be valuable for defenders to assess the quality and completeness of CVEs from various sources, helping them understand which CNAs provide more reliable data.

Furthermore, the looming threat of fragmentation in vulnerability numbering systems (e.g., EUVD, GCV) poses a significant risk. If the industry fails to unify these systems, defenders will face the daunting task of correlating multiple, disparate vulnerability identifiers to gain a complete picture, effectively reintroducing complexity and inefficiency. Defenders should advocate for and support efforts to keep the CVE program as the core, integrating new regulatory requirements into existing structures.

In essence, the defensive implication is clear: embrace automation and machine-readable standards. Organizations need to invest in tools and processes that can consume CSAF and VEX data, leverage it for intelligent prioritization, and streamline their vulnerability management workflows. This proactive shift is not merely an optimization; it is becoming a necessity for maintaining effective cybersecurity posture in the face of an ever-growing tsunami of vulnerabilities.

Key Takeaways

• Exploding CVE Volume: The volume of CVEs is escalating rapidly, driven by advancements in AI-driven vulnerability discovery and new regulatory requirements like the EU's Cyber Resilience Act (CRA). This trend makes the current, largely manual system unsustainable.
• Astronomical Hidden Costs: The global human cost of managing CVEs is immense. A Copilot-assisted estimate suggested a staggering 200 million human hours could be spent globally on a single Windows CVE, highlighting the profound inefficiencies in current vulnerability response.
• Machine-Readable Standards are Essential: Standards like CSAF (Common Security Advisory Framework) and VEX (Vulnerability Exploitability eXchange) are critical for introducing automation and efficiency. They enable machine-readable communication of vulnerability data, moving beyond human-intensive interpretation.
• VEX Shows Real-World Impact: Microsoft's publication of VEX statements for Azure Linux has seen significant adoption, with over 100 million requests in March. This demonstrates that VEX is actively being consumed by the industry and provides tangible value by clarifying product-vulnerability relationships.
• Inconsistent CVE Quality: The quality and completeness of CVEs are highly inconsistent across the industry, with a small number of CNAs producing most records, and even top producers struggling with 100% data enrichment (e.g., accurate CVSS, CWEs). This inconsistency complicates automated processing and reliable prioritization.
• Industry Collaboration is Imperative: The security industry must collaborate to build better tooling for creating and consuming standardized vulnerability data. Relying solely on regulators or MITRE is insufficient. Preventing the splintering of the CVE ecosystem into multiple, disparate numbering systems is also crucial for global defense.

About the Speaker(s)

Lisa Olson is a Principal Program Manager at Microsoft, where she has been a dedicated member of the Microsoft Security Response Center (MSRC) team since 2013. Her primary focus revolves around the monthly "Patch Tuesday" release cycle, a complex and ever-evolving endeavor that she describes as a job that is "the same... but every month it's different. Every month there's new challenges." Her extensive experience in managing the intricacies of vulnerability disclosure and patch deployment provides her with a unique and authoritative perspective on the challenges and future directions of the CVE program.