Author: Gene Moody, Field CTO at Action1

AI can help us find vulnerabilities faster than ever. But what happens when the rest of the vulnerability management ecosystem can’t keep up?

When Vulnerability Volume Outpaces the System

In April, NIST released a statement regarding updates to NVD operations that reflects a necessary response to scale. CVE volume has grown beyond what the current enrichment model was designed to handle. As part of the change, roughly 30,000 vulnerabilities published before March 1, 2026, were reclassified as “Not Scheduled.”

Prioritization, automation, and selective processing are reasonable adjustments in principle. In practice, however, the shift introduces a set of risks that may not be fully understood, particularly for those responsible for defending enterprise environments.

The pressure is not theoretical. Action1’s 2026 Software Vulnerability Ratings Report found that disclosed vulnerabilities across the enterprise software categories analyzed increased 92% in 2025 compared with 2024. Critical and high-severity vulnerabilities increased 103% each, while vulnerabilities enabling remote code execution increased 128%. 

Today, the volume of disclosures that must be validated, enriched, prioritized, and ultimately remediated is likely to place even greater pressure on systems designed for a slower era of vulnerability discovery.

The core issue is therefore not simply the existence of a backlog. Backlogs are an expected outcome in any system operating under rapid growth. The concern is how that backlog is managed and, more importantly, what signals are created by the decision to prioritize newer vulnerabilities over older, unprocessed ones.

What Happens When Enrichment Falls Behind

By focusing enrichment efforts only on recent CVEs, the system implicitly deprioritizes vulnerabilities that may already be known, confirmed, and, in some cases, actively discussed by vendors or researchers but lack full NVD context. 

This creates an information asymmetry of a particularly difficult kind: partial intelligence without the second half that makes it readily actionable. Security teams that rely heavily on NVD as a normalized source of vulnerability information may see incomplete or delayed data.

Attackers, meanwhile, do not need to wait for standardized enrichment before correlating vendor advisories, security research, patch releases, exploit information, and public disclosures.

That gap matters because enrichment is not cosmetic. Structured metadata, affected-platform information, severity scoring, configuration details, and other contextual information allow defenders to determine whether a vulnerability actually applies to their environment and how urgently it should be addressed.

When that information is missing or delayed, organizations are often forced to either wait for additional context or make decisions using fragmented information. Neither outcome is ideal in a threat landscape where exploitation can move faster than internal validation and remediation processes.

But That’s Not All

There is also a second-order effect that is harder to quantify but equally important. A rolling backlog that is continuously fed while being selectively drained creates uncertainty about coverage. Without a clear commitment to processing older entries within a defined timeframe, the backlog becomes a semi-permanent condition.

Some vulnerabilities will be enriched quickly, others will remain in limbo, and there will be limited visibility into which category any given CVE falls into at a given moment.

For practitioners, this overly complicates prioritization. If affected-product information such as CPE data is incomplete or overly broad, organizations face a greater risk of false positives. Teams may spend time investigating vulnerabilities that do not apply to their environment while potentially overlooking risks that do.

Over time, this will certainly erode confidence in the dataset and push organizations to build alternative intelligence pipelines. That will lead to additional cost, tooling, and operational complexity. As well, as one may predict, increasing failure rates.

Vulnerability Management Is Changing

None of this suggests that NIST is acting irresponsibly. The scale problem is real, and the existing model was not designed for the volume of vulnerability information now entering the ecosystem.But the introduced trade-off pushes more responsibility downstream.

Organizations will need to rely less on a single authoritative source and more on correlation across multiple sources, including NVD, vendor advisories, independent vulnerability-intelligence providers, threat intelligence platforms, and internal asset inventories.

Zoom out, and the view is that vulnerability management is becoming less about consuming a curated list and more about synthesizing accurate intel from incomplete data in near real time. That requires maturity, tooling, and process discipline that not all organizations currently possess. 

If this direction continues, the NVD will remain a critical component of the vulnerability-management ecosystem, but it will no longer function as a comprehensive baseline on its own. Instead, it becomes one input among many, and one that may lag significantly behind the realities of exploitation in the field.

The more important question then becomes not simply, “What vulnerabilities exist?” but “Which of them affect us, which represent the greatest risk, and how quickly can we act?”

How Defenders Should Adapt

The first lesson is that vulnerability management can no longer depend on any single source of enrichment. NVD remains enormously valuable, but security teams increasingly need to subscribe to cumulative works of vendors and organizations that aggregate the available data into usable intelligence

More importantly, collecting additional feeds is only part of the answer. More information can simply create another prioritization problem. The real objective is to turn fragmented vulnerability intelligence into a decision: Does this vulnerability affect us, how urgent is it, and what can we do about it now?

This is the model Action1 has adopted for vulnerability management. Rather than relying exclusively on NVD enrichment, Action1 combines intelligence from sources including VulnCheckNVD++, NIST NVD, CISA’s KEV Catalog, Microsoft’s own MSRC data, and vendor release notes, then scores each vulnerability based on CVE data, CVSS severity, CISA KEV status, and known usage in ransomware campaigns, providing initial prioritization in minutes.

That intelligence is correlated with real-time endpoint data so teams can determine which vulnerabilities actually affect software deployed in their environment and prioritize remediation accordingly.

Once an affected endpoint has been identified, remediation should not require another export, manual correlation exercise, or lengthy handoff before patching begins. 

Action1 brings vulnerability assessment and remediation into the same workflow, allowingorganizations to move from learning that a vulnerability exists to reducing actual exposure much faster, all from a single console.

The AI vulnerability era will not be defined by how fast IT and security teams can find flaws, but by how quickly they can understand, prioritize, and patch them. Discovery is accelerating, soremediation must accelerate with it.

See how Action1 connects real-time OS and third-party vulnerability intelligence with automated remediation to help your team reduce exposure faster. 

Start free and scale when you’re ready.

Sponsored and written by Action1.

The Tottenham vs Newcastle live stream involves two teams looking for their first wins of the new season. Tottenham were humbled by Brentford on matchday one, while Newcastle were denied all three points by a last-gasp Liverpool equaliser.

There were few positives for Roberto De Zerbi to take from this side’s display against Brentford. Spurs finished 17th last season, and their performance at the Gtech Community Stadium was worse than most of their showings in 2025/26. The only saving grace is that Tottenham’s starting XI will be significantly different going forward, starting with the visit of Newcastle.

Apple’s next big iPhone event is almost here, with the iPhone 18 Pro, iPhone 18 Pro Max and the company’s first foldable, the iPhone Ultra, all expected to make their debut.

The event will also mark the first major Apple product launch since John Ternus takes over as CEO on September 1. As with recent launches, Apple will combine an in-person gathering at Apple Park with a prerecorded presentation.

When is the iPhone 18 Pro/Ultra event?

The event will take place on Wednesday, September 9, starting at 10am PDT (1pm EDT). For other regions, the event starts at 6pm BST in the UK, 7pm CEST in Central Europe and 10:30pm IST in India. Viewers in China can tune in at 1am CST on September 10, followed by 2am JST in Japan and 3am AEST in Sydney.

Apple’s official event page also includes an Add to Calendar option, which automatically adjusts the event time for your location. It’s worth opening the stream a few minutes early, particularly if you want to catch the opening announcements.

What just happened? A federal judge has ordered the Trump administration to rescind its designation of Anthropic as a supply-chain risk, ruling that the government violated the AI company’s First Amendment rights. The decision found the designation was not supported by evidence of a genuine national-security threat and instead stemmed from Anthropic’s objections to Pentagon plans for using its AI models.

US District Judge Rita F. Lin ruled late Thursday that the government failed to show Anthropic posed a national-security threat. Instead, she found that officials acted against the company after it publicly challenged the Pentagon’s plans for using AI.

“Defendants’ contemporaneous words and deeds confirm that the challenged actions were based on a desire to make a public example out of Anthropic for its ‘arrogance’ in criticizing the government,” Lin wrote.

The ruling requires the government to withdraw guidance, directives, and other communications that blacklisted Anthropic or labeled it a supply-chain risk.

Anthropic sued the administration in March after talks with the Pentagon over military use of its AI models broke down. The company had asked for limits on the use of its technology in fully autonomous weapons and domestic surveillance. The Pentagon wanted an agreement allowing the military to use Anthropic’s models for any legal purpose.

The dispute centered on whether Anthropic could place limits on how the government used its models after making them available to federal agencies. The Pentagon viewed Anthropic’s proposed restrictions as too narrow for military operations. Anthropic said the limits were needed for high-risk uses of AI.

Government lawyers argued that the Pentagon was allowed to choose vendors it considered reliable. They said Anthropic could make undisclosed changes to its models that might affect military operations.

“The Department of War needs to trust that its AI vendors are going to be forthright and honest with the department,” government attorney James Harlow said during court arguments.

Lin questioned that position during the case. At a July hearing, she called the government’s argument that it could retaliate against a contractor for criticizing the administration “really troubling” and “quite extreme.”

The designation had immediate business consequences for Anthropic. The company said the government action led to hundreds of millions of dollars in canceled, shortened, or delayed contracts. Documents filed in the case showed rivals, including OpenAI, were preparing to replace Anthropic in parts of the federal government.

The decision also comes as Anthropic’s technology remains in use across the US government. Claude has been used by the military, including in the January raid in Venezuela and the war with Iran. Other federal agencies continue to use Anthropic products, including Fable and Mythos.

Lin said that continued government use undercut the Pentagon’s claim that Anthropic was a national-security risk. She had previously issued a preliminary injunction in March that blocked parts of the designation while the case moved forward.

Anthropic and the administration reached a separate agreement in June that allowed the company to release Fable and Mythos following a shutdown tied to security concerns. That agreement did not resolve the lawsuit over the blacklist.

The Defense Department did not immediately respond to a request for comment. The administration could appeal Lin’s decision. A separate case involving Anthropic remains before a federal appeals court in Washington, which denied the company’s request in April to block other parts of the designation.

Everyone’s waiting for Nvidia to confirm this week’s most interesting tech deal: A reported $13 billion acquisition of Hugging Face, a platform for sharing open-weight AI models and benchmarks.

Now best known as the target for a team of reward-hacking OpenAI agents, Hugging Face is at the center of the ecosystem of developers building and deploying LLMs that aren’t owned by frontier labs. Think of it as a kind of GitHub for the AI era.

Rumors of that deal come after Nvidia struck a $6 billion agreement with Poolside, an open-weight model builder, that will see most of its employees move to the chip-making giant. And two weeks ago, Stripe acquired OpenRouter, the top provider of open-weight models to businesses, for more than $7 billion.

That’s a lot of capital pouring into a sector based on giving stuff away, and it reflects the latest trends in the AI sector.

For Nvidia, there’s a need to avoid further dependence on its deals with the major hyperscalers and frontier labs. That’s particularly the case when major AI model builders like OpenAI and Google are also building their own inference chips, like OpenAI’s Jalapeño, whose capabilities were announced this week. If model builders are making chips, Nvidia wants a chunk of the model-making business.

Nvidia already builds its own Nemotron family of open-weight models, but their uptake hasn’t been huge. By taking control of the largest U.S. developer space for open models, the company will have access to a mass of users it can drive to its chips and standards.

There are also growing questions about the cost of AI inference, which has companies exploring cheaper models built by Chinese companies like Moonshot, DeepSeek, and Alibaba. Right now, adoption is relatively small but growing — just 6% of companies use open-weight models, according to a survey of spending data by Ramp, or just 2% of software engineers measured by Jellyfish, which makes tools for developers.

Nik Albarran, the AI product lead at Jellyfish, told TechCrunch that open-weight models are primarily used by companies whose products rely on repeated inference workloads, like those providing customer service chats. Because these are high-volume tasks with a lot of repetition, an open-weight model can be tuned to answer the questions cheaply.

That’s certainly how Stripe has framed its OpenRouter acquisition. “Tokens are the central currency for companies building with AI, and it’s clear that the real-world economic potential will depend on making good use of scarce compute resources,” Patrick Collison, Stripe’s co-founder and CEO, said in a statement.

For coding and agentic tasks, however, varying requests and more reasoning mean that frontier models often win out, in part because the proprietary labs provide easier access, and in some cases a token subsidy. Albarran says that as companies dial in AI workflows, it will be easier to turn to open models. Still, the main reason companies look to those models now is for control and configurability, not because of spending concerns.

“There are not many companies where that is the case yet … [but] if the prices continue to go up from the frontier labs, more and more companies will be forced to at least consider it,” Albarran told TechCrunch. “When your AI-driven workflows are much more mature, that’s when it makes sense to invest in self-hosting models.”

Lin Qiao is the CEO of Fireworks, a leading open-weight models router and host for corporate users that is often discussed as a potential acquisition for a tech giant. Qiao says her company processes 40 trillion tokens a day, more than either of Gemini’s or OpenAI’s APIs.

Fireworks’ bet is on model diversity: As LLMs proliferate and improve, it will be easier for companies to train them specifically for their needs. “Every single app company should consider hiring an in-house researcher,” she told TechCrunch last week. “They can use their product and product data to build their own model. The future is actually specialized intelligence. Literally, every single company should have their own model per use case, and that will happen automatically.”

It’s easy to forget how early we are in the development of AI as a tool and a business. The dominance of OpenAI and Anthropic, however, isn’t inevitable. As the tech giants look to hedge their bets on the biggest labs, the allure of open technology is proving tough to resist.

We have entered the age of biohacking now. And no, I am not talking about the extreme cases like Bryan Johnson, who is spending millions of dollars on ambitious health and de-aging goals. The average audience for wearables is now asking for more. They are feeding the sensing data collected by smartwatches, bands, and rings to AI agents, and pulling in more insights about their bodies. I created one such dashboard for myself using Claude in less than 10 minutes to make sense of the data collected by my smart ring. 

But there is only so much you can do with these wearables. And that’s owing to the limitations of the underlying light-based sensor. These sensors started with measuring heart rate, and in a decade, they made impressive advancements and can now measure ECG, blood pressure changes, temperature fluctuations, and blood oxygen saturation levels. They can’t, however, dig into the biochemical side of things, the kind of stuff that requires a hospital visit or sophisticated medical gear. 

When it comes to health and wellness, light-based analysis of the human blood is not the holy grail. Far from it, actually. There are a bunch of other fluids that are a treasure trove of health data. Saliva, urine, tears, and cerebrospinal fluid are among them. But in the realm of wearables, sweat has long been seen as the next big avenue for biosensing, especially for mass-market wearables. The challenge? It’s an entirely different kind of engineering challenge.

But why sweat?

We are dealing with fluids here, and to perform a chemical analysis, one needs nothing short of a mini lab. Microfluidics is the field that has been trying to create these mini labs. Caltech researchers recently made a skin patch that can measure cholesterol levels using a sweat sample. The folks over at Pennsylvania State University also developed a similar patch back in 2023. But cramming all that sensing kit into something as small as a ring that enables continuous monitoring (and that too, for multiple chemicals at the same time) has been a daydream, so far. 

Enter Tamoghana Saha, whose team at the University of California San Diego has developed a smart ring that can keep an eye on glucose, ketones, vitamin C, uric acid, lactate, and even alcohol levels by reading a sample of your sweat. And it’s not a one-off analysis. The ring, which the team calls the Continuous Health Analyzing Ring Module (CHARM), can perform continuous sweat analysis for a spell of 12 hours per charge, and maintain its calibration for a spell of two months. 

It’s a huge milestone that just needs some time and polish.

The ring is bulky. It’s not waterproof. It has not been validated in clinical settings on human subjects. It can’t do multi-day monitoring. But it’s still a ring, with upgradability and repairability as a key design principle. But above all, it’s living proof that chemical analysis of your sweat is now possible right on your index finger. And it’s going to be far more versatile than a typical smart ring that can only perform a proxy light-based analysis of the blood flowing in the vessels under your skin. 

Digital Trends sat down for an interview with Saha to discuss the CHARM ring, the challenges, and what it says about the future of smart rings. Let’s start with the basics. The CHARM smart ring is capable of measuring glucose, ketones, vitamin C, uric acid, lactate, and alcohol levels from your sweat. That’s a sizeable selection of biomarkers, and what they can reveal about your health and fitness levels is even more diverse.

Check out this brief overview of what an analysis of these chemicals can reveal about body health and recovery in response to medication, diet changes, and workouts in general:

Here’s the most encouraging bit. What you see in the table above is just surface-level analysis. Once you combine it with data collected from other wearables — let’s say a smartwatch or fitness band — the potential is nearly endless. Interestingly, that’s also a long-shot goal for the team at UC San Diego.

It’s a whole new lab

But why not just focus on the current crop of light-based sensors you get on the likes of the Apple Watch Series 11 or Oura Ring? Why explore sweat instead of taking an optical peek at the blood vessels?

“We wanted to target nutrition and diabetes in general, because if you take the individual biomarkers, their sensing mechanisms are quite well established,” Saha tells Digital Trends. “This project was mostly about showing that if you miniaturize everything, you can integrate the necessary sensors, and you can shove everything into a small form factor like that of a ring.” 

It wasn’t just the technical feasibility that was a crucial victory here. The team also demonstrated that a small portion of our finger was enough for sweat analysis, and that you don’t necessarily have to stick a sensor patch on a wider area like your biceps, thighs, or back. 

“I think, through this paper, we conveyed that, first of all, your ring location area, which is called the proximal phalanx, is a viable location to do sweat sensing, which people hadn’t done. I think this was a major, major message that we wanted to send out to everyone who works in these fields.”

And finally, it’s the convenience of having a non-invasive, low-effort system to analyze sweat without you even noticing it. “Unlike other existing sweat-based wearables, which mostly function with exercise, or use chemical stimulation (they inject a drug that makes you sweat), we work with passive sweat.”

That means you won’t have to exercise to generate sweat, or worry about a chemical acting in your body to pull sweat on your skin. Instead, the team relied on a compact circular slot on the ring that contains hydrogel, which uses osmotic pressure difference to draw out sweat from the skin.

“So that’s the unique part, and the thing is completely passive. The hydrogel is acting like a pump. There is no power consumption in sweat extraction,” Saha tells me. Talking about power consumption, the team created its own rechargeable battery that lasts up to 12 hours per charge. 

Trust and versatility

The biggest victory is the versatility. The CHARM ring can measure four biomarkers simultaneously. Additionally, the sensing system, which is based on a sensor–microfluidic assembly, can maintain its stability for two months, which means you won’t have to frequently calibrate it based on the readings you get from a traditional blood-based test.

But what about the accuracy? Saha says the team measured the ring’s accuracy against commercially available blood meters and continuous glucose monitors (CGMs), and the accuracy was analyzed across multiple metrics. Readings were taken in different scenarios, such as after alcoholic drink consumption, having a candy, and post-dinner, in order to measure the rise and fall in biomarker levels such as glucose, lactate, and alcohol.

When compared against devices that are used in clinical settings, the CHARM ring impressed with a low error range and high reliability in measuring the spikes and drops in biomarker levels. Additionally, all the data points collected by the ring fell in the A and B Zones (as per the Clinical Error Grid accuracy metric used by the US FDA), which means the results are either accurate or they are safely within a range where they won’t cause any harm if the readings are slightly off.  

The team also went with paper-based microfluidics instead of the traditional microfluidic channel architecture. Saha tells me that conventional microfluidics is susceptible to fouling, with one of the core issues being salt accumulation. Using paper also proved to be the more cost-effective choice, while the hydrogel acts like a passive pump to draw out sweat without using any energy. 

It’s still a work in progress. Beyond the engineering challenges, there’s the long process of clinical validation, which can easily take years, before the underlying tech makes it to the market. Why not just put it out there with a disclaimer? The likes of Google, Apple, and Samsung make it clear that their watches and rings can measure heart rate and sense blood pressure, but they are not meant as a replacement for medical-grade devices for measuring biomarkers, even though these mass-market wearables offer a high degree of accuracy. 

For now, Saha’s team has no such plans, but there are a few bright prospects. When asked where he envisions the device to be a better fit — at home or in a hospital setting — he tells me it could be suitable for both. 

“I would say that such a form factor, to be honest, is applicable everywhere, even in a hospital setting. For example, if a person is septic. Now, lactate is a key biomarker for septic patients, and sepsis is a slow process where your blood lactate levels are very high, and then they become extremely high over a period of time,” he explains. “So, I think if a patient comes to the clinic, instead of hooking up wires or bulky devices, a smart ring like CHARM can give information about their well-being by continuously recording their blood lactate levels and warning them about any worrisome spikes.”

Fixing historical flaws

I also asked about the repairability and upgradability aspects, because these happen to be the biggest weak spots of modern-age smart rings, and even smart watches with a fused sensor assembly. They can handle splashes, but if anything goes awry, the only option left is an expensive replacement. Repairs are simply out of the question. For the CHARM team, it is “a key consideration,” Saha tells me. 

The team is currently focused on fixing a few underlying problems. Making the ring waterproof is one of the key areas of improvement. The ring currently has an open hinge-lock design, but the team hopes to achieve a fully enclosed architecture, like the current crop of smart rings. Replaceable modular components are a key objective, alongside a rechargeable battery format and sustained multi-day biosensing. 

The team also aims to conduct clinical tests among a wider pool of patients with different tiers of diabetic ailments, and hopes to add more biomarkers to the support pool. How about merging a light-based sensor with a microfluidic-based sensing module on the same ring? 

“That is possible,” Saha tells me, adding that we might see such an all-in-one model in a year or two. The CHARM team refers to that vision as a multimodal chemo-physical hybrid ring. The ultimate goal is to develop a “practical, user-friendly multi-biomarker wearable monitoring platform” that looks like a ring. 

It’s an extremely ambitious idea, but Saha is also extremely cautious about giving a definitive roadmap. Biosensing is a field that has been built atop decades of work, and measuring biomarkers is not a straightforward lab-to-body journey. The painstakingly monitored clinical analyses and external validation are the real litmus test. It takes years, if not decades, before one can confidently push an entirely new kind of multi-biomarker wearable device.

You don’t want a repeat of what Oura is going through right now, after all!

Thankfully, CHARM is in the hands of an academic institution, and not a corporate entity hell-bent on maximizing profits riding atop zealous claims. Saha notes that the CHARM ring is a proof-of-concept with promising results. It would, however, take some time before we see a ring with the underlying tech appear in a retail shop. The future of wearable sensing, nonetheless, is full of possibilities.

Looks like Xbox is developing more than one next-gen console.

from the good-deals-on-cool-stuff dept

The SunFounder Raspberry Pi Pico With the Ultimate Starter Kit offers a rich IoT learning experience for beginners aged 8 and up. With over 450 components, 117 projects, and expert-led tutorials, this kit makes learning microcontroller programming and IoT engaging and accessible. It also features 27 video lessons by renowned educator Paul McWhorter, simplifying microcontroller programming and IoT concepts. Packed with diverse hardware, including sensors, actuators, LEDs, and LCDs, it enables endless experimentation and creativity. Supporting three programming languages, MicroPython, C/C++, and Piper Make, the kit caters to varying skill levels while fostering coding versatility. With dedicated technical support and a vibrant online community, this all-in-one starter kit ensures a seamless, hands-on journey into the world of IoT. It’s on sale for $65 for a limited time.

Note: The Techdirt Deals Store is powered and curated by StackSocial. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal