CISA moves vulnerability coordination off CERT/CC's VINCE onto its own platform

The practical change for a reporter is which login holds the case file. VINCE was built in 2020 by CERT/CC, a unit of Carnegie Mellon University's Software Engineering Institute, and CISA has used it since that year ^[5]. VINCE-NT is CISA-managed, and the agency says the change moves ownership, sponsorship and management of the platform to its Coordinated Vulnerability Disclosure team and lets the platform integrate with CISA's internal tools and processes ^[2][3].

"VINCE-NT is a modernized, CISA-managed platform for vulnerability reporting and coordination. It improves how vulnerability reporters, product suppliers and CISA case managers collaborate throughout the disclosure process," CISA said in an announcement posted on social media on September 17 ^[7].

Active cases move over the coming weeks, and a case coordinator contacts each stakeholder with the transition date, so the migration is per-case ^[8][9]. Inactive cases do not move at all; they stay on VINCE ^[10]. Anyone who needs the history of a closed multi-party case therefore has two systems to search. The announcement does not say how long the old one stays reachable.

The vocabulary changed too. "Vendors/developer/maintainer" is now "supplier," "product" is now "component," and "researcher/finder" is now "reporter" ^[6]. That matters for anyone whose intake automation, ticket templates or disclosure policy references the old field names. CISA said organizations should update internal reporting procedures so submissions go through VINCE-NT ^[11].

On the platform itself, CISA lists a simpler submission interface, better triage prioritization, automated advisory publication workflows, built-in collaboration tools that protect sensitive data, more case metrics for the CVD team, and stronger support for multi-party coordination ^[1]. Those are the agency's own descriptions of its own build. The announcement includes no third-party assessment of them, and says nothing about how case data was moved or what access CERT/CC retains to material that stays on VINCE.

Nothing here is being attacked, and no CVE turns on it. The change is custody: a coordination workflow that a US federal agency rented from a university-run center for six years is now built and managed by the agency, with the case metrics flowing to CISA's CVD team ^[2][3]. For a reporter filing to CISA, the requirement is a new account and a corrected internal runbook. For a supplier receiving multi-party notifications, the harder question is whether embargo handling and participant lists behave the same way on a platform whose operator also runs the US federal disclosure program.