A critical severity code execution vulnerability with public exploit code sat outside most security remediation pipelines for 28 days. This is due to systemically flawed designs of pipelines that overly rely on NVD. As time-to-exploitation approaches zero, a month-long delay isn’t good enough, so Specular built an alternative. This 2-part series sets out the problem, the background, and Specular’s extensible, multi-source, low-cost pipeline to surface vulnerabilities weeks before CISA KEV and begin responding to new vulnerabilities the next day.
In an era of rapid exploitation of new vulnerabilities, knowing what to respond to and when to start is key. But the tools built to kickstart that response pipeline have a central flaw: over-reliance on the National Vulnerability Database (NVD) as a sole source of truth. In part 2 of this series, we’re going to show you the pipeline Specular built to catch critical vulnerabilities weeks earlier.
Specular’s new architecture
We treat the lateness of the NVD pipeline described in part 1 as an architectural problem. Specular’s new architecture replaces single-source ingestion with a set of agents that continuously monitor threat intel sources and vendor advisories to identify newly disclosed vulnerabilities, often before CVE information is formally available.
Specular analyzes sources across threat intelligence, code repositories, and vendor advisories to identify newly disclosed vulnerabilities (and show which have public proof of concept exploit code), often before cve.org reserves a CVE identifier. We also built in self-healing based on NVD publications to avoid duplicate findings when that delayed NVD control possibly fires.
Finally, this architecture is extensible-by-design. We’ve built in several disparate data sources, but the nature of cyber defence means continuously reacting to in-the-wild attacks, so new sources are always coming online. Adding a new source to this pipeline is a minor change (including ISAC and proprietary threat intelligence feeds), which carries through the same pipeline and consolidation as the rest of the architecture.
Evaluating against a specific critical CVE
In late July, a critical remote code execution flaw in a widely used self-hosted developer platform became fully public. This became public via a GitHub Security Advisory (GHSA) at a repository-level, not the global database. The advisory had a CVSS score of 9.8, and working exploit code appeared in public repositories soon after.
CISA added it to the KEV catalog 28 days later. For most security programs, this was the first moment the vulnerability entered their remediation queue. Against a time-to-exploitation now measured in days and trending to zero, that is far too slow.
Specular's pipeline picked it up the next day after the vendor advisory and the first exploit code, 27 days before it reached KEV. This difference comes from where Specular’s pipeline takes its first signal, specifically:
- A public CVE or cve.org entry was not available in-time.
- KEV would have fired too late.
- Even watching for advisories for the specific product would not have caught it, due to the level of GHSA raised.
- Specular’s pipeline flagged it due to PoC code from two distinct authors.
Taking the sample further, measured against over 70 recent KEV entries as of August 26, 2026, Specular’s layered pipeline catches roughly half of them before NVD-reliant pipelines do, with an average head start of about three weeks.
For a defender, three weeks is enough time to patch an exposed instance before an opportunistic scan reaches it. But, there is more work still to be done for all defenders to match a near-zero time-to-exploitation.
Evaluating on cost
Most of the case for this approach is about efficacy. But the cost picture is worth exploring well, because the standard answer to a discovery gap is to buy your way out of it, which is something not every organization can afford to do. We looked at three options:
- A commercial pre-NVD intelligence feed. Around $200,000 a year, recurring, with no build effort.
- Mirroring and analyzing the whole of cve.org. Includes catching reserved-only identifiers that may never publish. Costs include compute for the entire registry and the highest build complexity of the three.
- Layered watchers. Public feeds and git repository pulls, with the cost sitting only in bounded, one-time engineering, not an ongoing line item.
We took the layered-watcher approach because it is easily extensible, increases coverage, increases the defender head start, and comes at no added cost. We strongly believe it is important to give as many organizations as possible this time advantage, and not price organizations with smaller budgets out of robust vulnerability pipelines. This discovery layer, along with the AI-driven analysis that determines whether a newly surfaced CVE actually touches your environment, is included in the core Specular platform.
Summary
Public vulnerability infrastructure is under strain, and a reliance on the NVD as the only source of truth has hampered many programs. A significant lag, coming up against AI-enhanced vulnerability discovery and near-zero time-to-exploitation, puts defenders on their heels, with many priced out of alternatives. Instead, watching a range of sources that move first has become the key part of a robust, modern vulnerability management capability, and it has delivered proven results for Specular and our customers.
If you want to see what this looks like against your own environment, get in touch to schedule a demo.