Comment Re:CVE process must step up (Score 1) 9
Such a shame that CVE quality is generally crap, as it's flooded with dubious 'findings' from people trying to build a resume as a security researcher. I'm not sure why you assert this is largely still done manually, reconciling with SBOM tools in my neck of the woods is pretty much automated for detecting and flagging issues because *no one* has time to deal with the gigantic volume of CVEs. Of course another problem in those SBOM tools is they have a terrible false positive rate. Trying to follow their guidance 100% may be impossible (complete misidentification) or requires significant work (SBOM tools don't do great with 'backported' fixes, and many software components don't bother with maintaining backward compatibility, so rebasing to a new version is big).
Updating software that is vulnerable is a key component, but I wager a greater general risk is how folks configure and operate credibly secure software stacks in insecure ways.