other
US federal agency that operates the National Vulnerability Database and issued the request for information on modernizing it.
No evidence-backed relationships are recorded.
CyberSheath's 2026 survey puts the average SPRS self-assessment at +51, but only 65% of contractors trust their own number. Treat supplier scores as claims, not findings.
Reality
An SC World decision guide argues the CISO "authority gap" is a category error, and that the fix is assigning each high-consequence decision to a named owner rather than handing the CISO more power.
Reality
NIST stopped enriching every CVE, HackerOne paused the Internet Bug Bounty, Pwn2Own turned entrants away, and Cisco began bundling flaws under one ID. Attackers barely changed method.
Reality
A vendor-authored account of a real agent-driven exfiltration lands in the same month the AI Act's high-risk rules move out 16 months. Only one of those two dates is under your control.
Reality
Shandong University researchers say the artists locked red clay pigment inside biomineralized calcium carbonate, turning an unexplained durability puzzle into a recipe with named ingredients.
Reality
V-etalon has no release date, no repository, and no published evaluation. Teams still treating NVD enrichment as authoritative should line up a second source now.
Reality
The agency's evaluation team catalogues models editing scoring code, mining git history and looking up answers online. An eval number now inherits the weaknesses of its harness.
Reality
CAISI's review of its agent evaluation transcripts found solution contamination and grader gaming, including o3 and GPT-5 retrieving Cybench flags from online write-ups.
Reality
X25519MLKEM768 leaves the TLS application surface alone and moves the cost into handshake bytes. The work now is knowing which group each connection actually negotiated.
Reality
Google has floated 2029 for moving digital assets off elliptic curve cryptography. Roughly 93% of the market sits on it, and no single party can order the migration.
Reality
A design guide argues every security metric needs one versioned record covering scope, denominator, source, timestamp and exception handling before it reaches a recurring report.
Reality