The Future of CVE | June 2, U.S. Capitol
NTSC Policy Working Session

The Future of CVE

Date June 2, 2026
Time 2:00 PM – 4:30 PM
Location U.S. Capitol
A "roll up your sleeves" session for practitioners to collaborate with legislative leaders.

Our Goal: To help shape the future of cybersecurity policy by providing direct insight and collaboration between active practitioners and lawmakers.

Attending
Invited
HSGAC Attending
HSCIP Invited
CISA Invited
NIST Invited
MITRE Invited
Leading CISOs Invited
Leading CNAs Invited
Researchers Invited
Threat Analytics Invited
Bug Bounty Orgs Invited

Working Agenda

2:00 PM

Vulnerability Incentives

For decades, the CVE system has served as the foundation for vulnerability management. However, mounting strain from exponential growth and fragmentation suggests a fundamental disconnect between system requirements and participant behavior.

This group will analyze how existing incentive structures shape the ecosystem. We will identify the specific safeguards and shifts needed to protect the integrity of the CVE system while ensuring it remains an effective tool for practitioners and policy makers alike.

3:00 PM
Networking Break (30 Minutes)
3:30 PM

Adjusting the CVE Vision

The emergence of Opus 4.6, XBOW, Raptor, AIxCC, and Mythos has redefined the pace of cyber operations. Adversaries now execute in minutes, exposing the fatal limits of security and governance models built for a slower era.

In this session, we will consider where the current vision for the CVE ecosystem must be adjusted to accommodate this reality. We will examine the critical requirements of speed, scale, and safe harbors to determine how our operating and regulatory models must evolve to meet the challenges of the post-AI era.

4:30 PM

Session Conclusion

Invitation Only

Participation is strictly limited. Specific room details within the Capitol complex will be provided privately.