Measuring CVE Performance Vuln4Cast 2024, Ben Edwards
https://bjedwards.observablehq.cloud/measuring-cna-performance/

Everyone is a CNA

(Except MITRE and CISA)

6 Distinct CNA Roles (Sort of)

Nearly everyone is solely a "CNA"

Likely all those Unknown's are "CNA"

Root CNAs

CISA ICS (Also CNA-LR)

Google

JPCERT

Red Hat

INCIBE

MITRE and CISA(not ICS) are Top-Level Root

CISA is currently the sole ADP

MITRE is the sole Secretariat and other CNA-LR