- CISA has authorized Flock as a CVE Numbering Authority, so it can assign IDs and publish records for flaws in its own branded products.
- Experts quoted by CyberScoop say trust depends on record quality, and that a vendor writing its own descriptions and severity scores creates a conflict of interest.
- Customers should ask for advisories listing affected versions and fixes, and for the rule Flock uses to decide whether a flaw counts.
A badge does not make a record trustworthy. The record does. That is the lesson in Flock's new status as a CVE Numbering Authority, or CNA. The company can now write the official entry for flaws in its own products. Whether anyone should rely on those entries will be settled one entry at a time.
What changed
Flock announced on October 6, 2026 that CISA, the US cybersecurity agency, had authorized it as a CNA. The company may now hand out CVE IDs for security flaws in products that carry the Flock brand. It can also publish the matching records straight to the public CVE catalog.
The scope stops at Flock-branded hardware and software. Flock says the role lets it acknowledge researcher findings, set disclosure timelines and give credit. Its chief information security officer, Chris Castaldo, said it will also end "confusion from duplicate or conflicting vulnerability entries."
How the system works
A CVE ID is a shared label for one specific flaw. It lets a city IT team, a researcher and a vendor all be sure they mean the same issue. Each flaw gets one record. Those records feed the US National Vulnerability Database, which NIST maintains.
Flock says it had relied on outside parties to request IDs for its flaws, sometimes before a fix was ready. As a CNA, Flock controls that step for its own products.
It also writes the description of each flaw. Katie Moussouris of Luta Security told CyberScoop that a vendor in this role "often sets the severity score." That is real power over how a problem reads to the public.
Why vendors get this role, and where the risk sits
Moussouris told CyberScoop that vendors make sense as CNAs if they keep accurate records. They know the code. They can confirm a flaw. They can tie it to affected versions and the fix.
The risk comes from the same control. She said a conflict of interest appears when a vendor lacks the maturity to judge flaws correctly. Such a vendor may misstate an issue, through ignorance or an effort to downplay it.
Zach Edwards, a security and privacy researcher, was blunter. He said CNAs are "essentially grading their own homework."
The lesson here is that a CNA role moves the editor's pen, not the facts. A buyer cannot judge the arrangement from the announcement. The judgment comes from reading the records as they appear.
The test case: a flaw that needs physical access
CyberScoop reports that researchers last year found several defects in Flock's license-plate reader and gunshot detection system. Flock sent them for inclusion in the National Vulnerability Database. It also judged them not material, because an attacker needs physical access to the device.
Moussouris answered in one line: "These cameras sit on poles on public streets." For a device built to sit outdoors, physical access may be an ordinary condition. How to score such a flaw is a policy choice. For its own products, that choice now belongs to Flock.
CyberScoop adds that Flock's new role highlights the limits of the CVE program, including what counts as a vulnerability.
What Flock has and has not said
Flock published its vulnerability disclosure policy in August, according to CyberScoop. It has also created a security advisories page for newly confirmed flaws. The policy bars testing on live customer systems and access to law enforcement data. It also bars physical attacks, denial-of-service testing and social engineering. CyberScoop says Flock runs no paid bug bounty program.
Flock declined to answer CyberScoop's questions. It offered no executive for interview and pointed back to its blog post. Edwards told the outlet he expects some researchers to keep disclosing Flock flaws without working with the company.
What buyers should ask
Cities, police departments and businesses that run Flock hardware have a practical lever. Moussouris said the measure of Flock is whether its records carry "enough detail and accuracy" to track specific risks. In plain terms, a reader should see which version is hit, what kind of flaw it is and, ideally, how to fix it.
Leaders can turn that into four questions. First, does each advisory list affected versions and a fix? Second, how does Flock decide whether a flaw that needs physical access gets an ID, and who can review that call? Third, will your security team hear of a flaw before its record goes public? Fourth, can your own staff compare Flock's advisories with independent researcher reports and flag any gap?
Procurement can also write these expectations into contracts and renewals. A vendor that scores its own flaws should accept outside checks on how it does so.
Trust in a self-reporting authority is built the slow way: one accurate record after another, including the awkward ones.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Flock Safety.
