Where the Vulnerability Ecosystem Comes Together

Overview

In 2024, the Forum of Incident Response and Security Teams (FIRST) and the CVE Program launched VulnCon, a conference dedicated to advancing the global vulnerability management ecosystem.

Where the vulnerability ecosystem comes together, VulnCon brings together vulnerability management practitioners, product security and PSIRT teams, researchers, CVE Numbering Authorities (CNAs), government partners, standards organizations, and technology providers. The event is built around practical collaboration, current technical challenges, and the shared work of strengthening the global vulnerability ecosystem.

VulnCon distinguishes itself through its focus on product security incident response (PSIRT), coordinated vulnerability disclosure (CVD), and vulnerability management. The conference provides a forum for sharing operational experiences, addressing emerging challenges, and exploring the evolving practices, standards, and programs that support vulnerability management worldwide.

VulnCon also serves as the annual gathering of the CVE Program's CVE Numbering Authorities (CNAs), bringing together representatives from around the world to discuss program developments, share best practices, and strengthen coordination across the CVE ecosystem.

About FIRST

FIRST (Forum of Incident Response and Security Teams) is an international, nonprofit association of trusted Computer Security Incident Response Teams (CSIRTs), Product Security Incident Response Teams (PSIRTs), and independent security researchers from the public, private, and academic sectors. Founded in 1990, FIRST promotes global collaboration in cybersecurity through incident prevention, coordinated response, and trusted information sharing.

Today, FIRST brings together more than 900 member teams across over 100 countries, forming one of the world's largest and most trusted incident response communities. Through best practices, tools, training, and trusted communication channels, FIRST helps strengthen the global cybersecurity ecosystem and enhances the ability of organizations to prevent, detect, and respond to security incidents.

About CVE® Program

The mission of the CVE® Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. There is one CVE Record for each vulnerability in the catalog. The vulnerabilities are discovered then assigned and published by organizations from around the world that have partnered with the CVE Program. Partners publish CVE Records to communicate consistent descriptions of vulnerabilities. Information technology and cybersecurity professionals use CVE Records to ensure they are discussing the same issue, and to coordinate their efforts to prioritize and address the vulnerabilities.