Tidal Cyber on Why CISA's End of the Weekly Vulnerability Bulletin Points Toward Threat-Led Defense

Tidal Cyber, a Veteran Ventures Capital Fund I portfolio company and developer of the Threat-Led Defense platform, published an analysis on September 21 of CISA's decision to stop publishing its weekly Vulnerability Bulletin on September 28. The bulletin has catalogued newly disclosed vulnerabilities since 2004, and CISA describes its retirement as part of a shift from severity-based vulnerability management toward a risk-based approach: under Binding Operational Directive 26-04, federal agencies are to prioritize remediation using factors such as evidence of exploitation and exposure rather than severity scores alone, with the Known Exploited Vulnerabilities Catalog as the model.

Tidal Cyber's argument is that the change confirms a problem the company named "CVE Myopia" in 2025: treating CVEs and their scores as the primary lens for security, so that attention follows the score regardless of its relevance to the adversaries a given organization faces. "The cybersecurity problem is no longer finding enough vulnerabilities," the post states, and "severity without context is not enough." More findings, in Tidal's account, produce more queues and more alerts rather than better defense, and a vulnerability with a high score can have little bearing on an organization whose attackers succeed through credential abuse, misconfigurations or legitimate administrative tools.

Risk-based management, the post argues, answers which vulnerabilities to address first. Threat-Led Defense goes a step further by connecting threat intelligence, adversary techniques and procedures to the defenses and detections an organization has in place, and by distinguishing intended coverage from proven effectiveness. The question moves from "What should we patch first?" to what the adversaries relevant to an organization can execute against it, and whether its defenses would interrupt that execution. The post closes by asking whether security is still being prioritized "based on what is easiest to count or on what is most important to defend."

The analysis follows Tidal Cyber's August partnership with Carahsoft to bring Threat-Led Defense to the public sector and the launch of its MCP server, which puts the platform's threat intelligence inside the AI assistants security teams already use. Tidal Cyber is headquartered in Reston, Virginia, and Veteran Ventures Capital invested in the company through Fund I.

VVC's view: CISA retiring a product it has published for over two decades is as clear a policy signal as the vulnerability-management market gets, and it moves the federal baseline toward the ground Tidal Cyber has been standing on since the company named CVE Myopia. When the government's own directive tells agencies to prioritize by exploitation and exposure, the next question an agency asks is which adversaries are exploiting what against it, and that is the question Tidal's platform was built to answer.

Sources: Tidal Cyber.

Image: Tidal Cyber