I think it is impossible to start talking about NVD, Vicarius and vsociety without talking about out Research team. It is also impossible to talk about the Research team from my perspective without introducing me, so I will start there. My name is Nahuel Benitez. I'm part of the Vicarius Research team working as a Security Analyst and leading the development of the scripting library. I'm in charge of making sure it's always improving in terms of quantity and quality.
When I arrived at Vicarius the vsociety project already had its history. There were already large amounts of excellent CVEs analysis, and large amounts of scripts as well, that allowed me to see the potential that this had. It was not only about generating an internal community that nurtures vRx but it was also about generating an impact on the entire cybersecurity community.
Our first big “hit” was the “CVE of the week” or “Villain of the week” as the marketing team nicknamed it along with drawings and animations that made it eye-catching. The CVE of the week consisted (and still does) of taking information from a trending vulnerability, summarizing it so that it is quickly understood in impact and importance, and then giving it the “Vicarius” contribution of two scripts that will not only allow you to detect the vulnerability mentioned in the post, but also mitigate it without patching.
Thanks to the success of this weekly delivery, we decided to go further and make the “Hero of the week” or “x_ops of the week” an operational script that with an elegant drawing of a superhero would help you to solve configuration, auditing, security and other problems.
All this was not a coincidence. In Vicarius we were working on something big and successful. We were contributing to the community with useful content and its momentum was becoming unstoppable.
The final proof of this was the integration of the vsociety references to NVD. The National Vulnerability Database, or NVD as it is more commonly known, compiles information from over 200 data sources and currently contains over 150,000 CVE vulnerability entries. Yes, the same NVD that tracks and catalogs the world’s CVEs is now pointing to our work as part of the official remediation guidance.
What this means is that:
- Our research is getting recognized at a national and global level.
- Security teams using the NVD can discover our scripts directly from the CVE entries.
- We're helping bridge the gap between disclosure and action, in a way that actually gets used.
This is a moment to be proud of the team that we formed within Vicarius, and at the same time a moment to reflect. There were many obstacles to overcome. Taking more relevance means more eyes on us. As a result, the efforts were doubled to ensure the quality of the scripts, the amount of scripts that vsociety offers weekly was also doubled, and our implementation process was made more rigorous because we understand that the community demands and requires it. Security should be actionable, not just a list of problems. That’s our goal. That’s why we do this.
We’re not stopping here. More scripts are on the way. More CVEs will get covered. And we’ll keep pushing for a faster, more automated way to respond to threats.
If you’ve been using our scripts, thank you. If you haven’t yet, now's a good time to start.
.jpg)
