2026-05-07 –, Room 3 Language: English
Vulnerabilities are the "bread and butter" of security, yet the ecosystem providing this data is more opaque and more fragile than we realize. We track CVE numbers like stock prices, but do we understand the machinery behind them?
As the volume of reported vulnerabilities explodes and new registries emerge, we face a critical question: What happens if the feed stops?
This session looks beyond the surface and examines the layers of the global vulnerability ecosystem. We will move beyond the four-digit ID to explore the "metadata soup" that powers our scanners and risk assessments.
Key takeaways include:
• The CVE Anatomy: A deep dive into the inner workings, history, and uncertain future of the CVE Program.
• Metadata Clarified: A breakdown of what vulnerability metadata actually tells us, who generates it, and more importantly when it lies or misleads us.
• The Registry Wars: Navigating the rise of new vulnerability databases and what this fragmentation means for open-source security.
• Actionable Intelligence: How to separate high-signal data from the noise and build a more resilient security posture.
Whether you're a maintainer, a researcher, or a defender, it’s time we stop taking CVEs for granted and treated as gospel and start understanding the data that drives our industry.
Bio: Katie Trimble-Noble
Director, PSIRT and Bug Bounty
Katie serves as a CVE Program Board, Bug Bounty Community of Interest Founder, and Hacking Policy Council Founding member. She is a passionate defensive cybersecurity community activist, she is regularly involved is community driven projects and is most happy when she is able to effect positive progress in cyber defense. In her day job Katie Noble serves as a Director of PSIRT, specializing in Global Secretarial Policy and Industry Engagement and Bug Bounty, at a fortune 50 Technology Company. Prior to joining private sector, Katie spent over 15 years in the US Government. Most recently as the Section Chief of Vulnerability Management and Coordination at the Department of Homeland Security, Cyber and Infrastructure Security Agency (CISA). Her team is credited with the coordination and public disclosure of 20,000+ cybersecurity vulnerabilities within a two-year period. During her government tenure, in roles spanning Intelligence Analyst for the National Intelligence Community to Senior Policy Advisor for White House led National Security Council Cyber programs, Katie’s work directly impacted decision making for government agencies in the United States, United Kingdom, Canada, and Australia.
Jeroen van der Ham-de Vos (he/him) is associate professor of Cyber Security Vulnerability Management at the University of Twente. His research currently focuses on vulnerability prioritisation and management, incdent response, the many developments in coordinated vulnerability disclosure and ethics of cybersecurity and computer science.
Jeroen has worked at the National Cyber Security Centre-NL from 2015 until 2023 as a cybersecurity researcher. There he coordinated the NCSC Research Agenda, was the national expert on Coordinated Vulnerability Disclosure, and was part of crisis teams such as with Wannacry or Log4J.