White House launches Gold Eagle to coordinate AI-driven vulnerability management

The US government has launched Gold Eagle, a programme to coordinate faster detection and remediation of cyber vulnerabilities, including those discovered by AI. The initiative was trailed in Executive Order 14409 in June and involves CISA, the Treasury, the Department of Defense, and private sector partners.

The White House described it as a coordinated system to receive and patch vulnerabilities at speed and scale never seen before, using existing federal authorities and resources. It aims to reduce duplicate scanning and deliver actionable remediation intelligence to network defenders.

The programme is believed to rely on the Vulnerability Information and Coordination Environment (VINCE), a collaborative project with Carnegie Mellon University’s Software Engineering Institute, to provide a central hub for reporting and triage. Open source maintainers are expected to be heavily involved.

However, cybersecurity experts have questioned whether the initiative addresses the real bottleneck. Jacob Krell of Suzu Labs argued that coordination does not create the engineers or vendor resources needed to deploy fixes, while Gunter Ollmann of Cobalt noted that prioritising and getting remediation to the right owner is where programmes break down. Justin Beals of Strike Graph said the release only describes the first half of what is needed, and that a measurement and accountability model downstream would be key.