The Baby Steps of the European Union Vulnerability Database: An Empirical Inquiry

TL;DR

This paper empirically analyzes the EU Vulnerability Database, revealing that actively exploited vulnerabilities are severe and highly predicted, with limited but growing European coordination and archiving efforts.

Contribution

It provides the first empirical assessment of the EU Vulnerability Database's content and European authorities' engagement, highlighting trends and gaps in cybersecurity governance.

Findings

Exploited vulnerabilities in EUVD are severe and have high exploitation prediction scores.

European authorities show limited engagement, with Spain being notably active.

European coordination and archiving to EUVD are increasing over time.

Abstract

A new European Union Vulnerability Database (EUVD) was introduced via a legislative act in 2022. The paper examines empirically the meta-data content of the new EUVD. According to the results, actively exploited vulnerabilities archived to the EUVD have been rather severe, having had also high exploitation prediction scores. In both respects they have also surpassed vulnerabilities coordinated by European public authorities. Regarding the European authorities, the Spanish public authority has been particularly active. With the exceptions of Finland, Poland, and Slovakia, other authorities have not engaged thus far. Also the involvement of the European Union's own cyber security agency has been limited. These points notwithstanding, European coordination and archiving to the EUVD exhibit a strong growth trend. With these results, the paper makes an empirical contribution to the ongoing work for better understanding European cyber security governance and practice.