Uploaded May 2026 | Updated September 2026, 1 hour ago
Eoin Wilson-Manion (Tharros Labs), Tyler Zellers (Tharros Labs), Jonathan Spring (CISA, US)
Vulnerability management, perhaps unsurprisingly, relies on information about vulnerabilities. The results of most coordinated vulnerability disclosure (CVD) efforts are, also unsurprisingly, disclosures, ideally public disclosures. What information does vulnerability management need? What information does CVD provide? How, in what formats? How do we assess quality and support automation? CISA Vulnerability Response and Coordination (VRC) publishes vulnerability information in CVE, CSAF, VEX, and a collection of related formats including SSVC, CVSS, CWE, and vers. This talk will detail our experience from collecting and analyzing vulnerability information to producing and publishing CSAF Advisories and CVE Records.
---
Eoin Wilson-Manion is a vulnerability analyst at Tharros Labs, where he performs Coordinated Vulnerability Disclosure (CVD) and contributes to related research and development efforts with his buddy Tyler!
Tyler Zellers is a vulnerability analyst at Tharros Labs, where he performs Coordinated Vulnerability Disclosure (CVD) and contributes to related research and development efforts.
Dr. Jonathan Spring is a cybersecurity specialist in the Cybersecurity and Infrastructure Security Agency. Working within the Cybersecurity Division’s Vulnerability Management Office, his area of focus includes researching and producing reliable evidence to support effective cybersecurity policies at various levels of vulnerability management, machine learning, and threat intelligence.
Eoin Wilson-Manion (Tharros Labs), Tyler Zellers (Tharros Labs), Jonathan Spring (CISA, US)
Vulnerability management, perhaps unsurprisingly, relies on information about vulnerabilities. The results of most coordinated vulnerability disclosure (CVD) efforts are, also unsurprisingly, disclosures, ideally public disclosures. What information does vulnerability management need? What information does CVD provide? How, in what formats? How do we assess quality and support automation? CISA Vulnerability Response and Coordination (VRC) publishes vulnerability information in CVE, CSAF, VEX, and a collection of related formats including SSVC, CVSS, CWE, and vers. This talk will detail our experience from collecting and analyzing vulnerability information to producing and publishing CSAF Advisories and CVE Records.
---
Eoin Wilson-Manion is a vulnerability analyst at Tharros Labs, where he performs Coordinated Vulnerability Disclosure (CVD) and contributes to related research and development efforts with his buddy Tyler!
Tyler Zellers is a vulnerability analyst at Tharros Labs, where he performs Coordinated Vulnerability Disclosure (CVD) and contributes to related research and development efforts.
Dr. Jonathan Spring is a cybersecurity specialist in the Cybersecurity and Infrastructure Security Agency. Working within the Cybersecurity Division’s Vulnerability Management Office, his area of focus includes researching and producing reliable evidence to support effective cybersecurity policies at various levels of vulnerability management, machine learning, and threat intelligence.
