The vulnerability intelligence system is broken.
Here's how to fix it.
Open-source tools and research for security teams who need signal, not noise.
RogoLabs
RogoLabs builds open-source tools that make vulnerability intelligence actionable. The name comes from the Latin rogo — "I ask" — the root of "interrogate." The mission is to relentlessly question vulnerability data to reveal what actually requires attention.
The problem isn't a shortage of CVE data. It's that most security teams are drowning in it — CVSS scores without context, feeds without signal, patch lists without priority. Every tool in the RogoLabs toolkit is designed to cut through that noise: visualize what's happening, predict what's coming, and prioritize what matters.
All tools are free and open-source. No vendor lock-in, no hidden costs — because better security tooling should be available to everyone, not just organizations that can afford enterprise contracts.
— Jerry Gamblin
The RogoLabs Toolkit
One mission — make vulnerability intelligence actionable.
Talks
Conference presentations on vulnerability intelligence, CVE ecosystem health, and data-driven security.
Introduces the Data Quality Assessment Framework (DQAF — pronounced "decaf"), a structured approach to measuring CVE data quality across completeness, accuracy, consistency, and machine-usability. The framework separates record design quality from record instance quality, enabling CNAs, NVD, and downstream consumers to benchmark their vulnerability data output. w/ Jay Jacobs (Empirical Security).
A builder session showing how to create a self-sustaining vulnerability radar using open-source tooling and the architecture patterns behind the RogoLabs toolkit.
Examining the critical need for CVE ecosystem decentralization in response to NVD challenges, exploring global alternatives and pathways toward a more resilient, distributed vulnerability intelligence infrastructure.
Analysis of strain in global vulnerability disclosure — CVE funding challenges and NVD backlog — and strategies for resilient, diversified vulnerability intelligence using emerging alternative sources.
Introduces CVEforecast.org and an ensemble approach — statistical, ML, deep learning, and CNA-specific forecasting — to shift vulnerability management from reactive response to predictive planning.
State-of-the-landscape analysis covering NVD backlog dynamics, CVE program funding stress, assignment consistency, and the emergence of alternative global vulnerability data sources and their operational impact.
Exploration of transparency gaps in CVE processes and their impact on vulnerability ecosystem trust and efficiency.
Empirical analysis of CNA performance gaps and methods to raise vulnerability reporting quality across the ecosystem.
Case studies on operationalizing EPSS to reduce patch workload while preserving risk coverage.