CVE/FIRST VulnCon 2025 & Annual CNA Summit

Raleigh (NC), US - April 7-10, 2025 | McKimmon Center | #VULNCON25

Check out the recorded content from the 2024 conference at YouTube

Please join us for the 2025 Vulnerability Management Ecosystem Collaboration, Ideation, and Action Conference (aka “VulnCon”) sponsored by FIRST and the CVE Program. The conference will take place April 7th through 10, 2025. The location for the event will again be the North Carolina State University, McKimmon Center.

The purpose of the conference is to collaborate with various vulnerability management and cybersecurity professionals to develop forward leaning ideas that can be taken back to individual programs for action to benefit the vulnerability management ecosystem. A key goal of the conference is to understand what important stakeholders and programs are doing within the vulnerability management ecosystem and best determine how to benefit the ecosystem broadly.

VulnCon is Co-Hosted by FIRST and the CVE Program. This event will be open to both FIRST members and non-members around the world who are part of the vulnerability ecosystem.

Mark your calendars for the return of this exciting conference!

We have an action-packed docket of dynamic speakers and cross-industry topics that we feel will accelerate collaboration within the vulnerability management and standards/frameworks space! This will be a must-see event for anyone involved in researching, reporting, triaging, mitigating, and communicating about security vulnerabilities. Some highlights from the agenda include:

• 40+ sessions across 4 full days of content and networking/collaboration
• PSIRTs, Vulnerability SIGs, Working Groups, and other vulnerability ecosystem experts presenting about CVE, CVSS, EPSS, KEV, VEX, CVD, SBOM, Incident Response, and others!
• Speakers from CISA, MITRE, ENISA, global CERT teams, the OpenSSF, FIRST, and other renown industry experts
• Actionable advice on how to engage with CVD across ecosystem stakeholders and how to use and align the assorted vuln metadata tools, frameworks, and standards

Some showcase sessions will include:

• A “Day of VEX” from practitioners
• A “Day of Vuln Identifiers” from practitioners
• Previous talk topics included “Supply Chain Security: The Office of the National Cyber Director Perspective”, “Vulnerability Coordination in the EU”, “What it takes to lead America’s Vulnerability Management Team”, and sessions from global CERT teams
• Expert panels on Industry CVD, Vulnerability identifiers, VEX, Decentralized Root Cause analysis, the risks of requiring premature vuln disclosure, and more!
• Detailed sessions updating frameworks like CWE, CVSS, EPSS, and others

Program Overview

A detailed agenda to be posted in March 2025.

• April 7 | Training Day 1, Vendor Tables, Welcome Reception
• April 8 | Training Day 2, Vendor Tables, Off-site Social Event
• April 9 | Plenary, Breakouts, Vendor Tables
• April 10 | Plenary, Breakouts, Vendor Tables

Registration Information

Discounted rates are not offered for this event regardless of membership or speaking status.

• Standard Admission (by March 9, 2025): US $300.00
• Late Rate Admission (after March 9, 2025): US $375.00
• Virtual Admission: US $100.00

Registration fees include four days of coffee breaks and buffet lunches, one networking reception hosted at the McKimmon Center, and applicable meeting materials.

An offsite social event is planned for Tuesday, April 8 from 19:00-21:00 in downtown Raleigh. Location to be announced in January. You may purchase a ticket during your main registration or access a separate purchase form link found in your registration email confirmation. Tickets are $30 per person.

Register Today!

Conference Venue