The US Cybersecurity and Infrastructure Security Agency (CISA) has upgraded its vulnerability reporting and coordination platform to allow for more automation and streamlined processes, as well as new built-in tools that vulnerability researchers can use.
Since 2020, CISA has been using Carnegie Mellon University's Vulnerability Information and Coordination Environment (VINCE), a vulnerability management platform developed that same year by the Computer Emergency and Response Team Coordination Center (CERT/CC), a unit of the university’s Software Engineering Institute (SEI).
From September 17, 2026, the US cybersecurity agency is now using VINCE – New Technology (VINCE-NT).
“VINCE-NT is a modernized, CISA-managed platform for vulnerability reporting and coordination. It improves how vulnerability reporters, product suppliers and CISA case managers collaborate throughout the disclosure process,” CISA said in an announcement published on social media on September 17.
The agency also said the change shifts ownership, sponsorship and management of the platform to its Coordinated Vulnerability Disclosure (CVD) team and enables improved integration with its internal tools and processes.
Enhancements include:
- A user-friendly interface that makes submitting vulnerability reports easier, safer and reduces friction
- Enhanced triage effectiveness enabling teams to better prioritize the most critical vulnerabilities
- Simplified advisory publication workflows through automation
- Built-in tools enabling transparent collaboration among all parties while protecting sensitive data
- Enhanced reporting case metrics, giving CISA’s CVD team actionable insights to improve coordination
- Stronger support for multi-party coordination and developing advisories
Additionally, VINCE-NT revamped some of the vulnerability terminology used by CISA until now. The “vendors/developer/maintainer” entry becomes “supplier,” “product” is replaced by “component” and “researcher/finder” is now “reporter.”
In an FAQ about the transition, CISA said active VINCE cases will be transitioned over the coming weeks.
For stakeholders who have active cases on VINCE, a case coordinator will reach out and convey the transition date.
Inactive cases will not be moved to VINCE-NT but will still be available on VINCE.
The US agency said organizations should update internal reporting procedures to reflect that vulnerability submissions to CISA should now be made through VINCE-NT.
Read now: Linux Foundation's Akrites to Go Live in September