Flock Can Grade Its Own Flaws — Cybersecurity News

Surveillance Check · Updated October 18, 2026 · This cybersecurity news story is about who gets to grade security flaws. On October 6, 2026, surveillance vendor Flock Safety was authorized to assign CVE IDs to vulnerabilities in its own products. Below: what happened, why experts are uneasy, and how to read a vendor-issued CVE.

Key figure: CISA's Known Exploited Vulnerabilities catalog listed 1,748 entries as of October 16, 2026, every one confirmed exploited in the wild (CISA KEV catalog, version 2026.10.16).

What is a CVE Numbering Authority?

A CVE Numbering Authority, or CNA, is an organization authorized by the CVE Program to assign CVE identifiers to vulnerabilities and publish the official CVE records. Each CNA has a defined scope — for Flock, that scope is Flock-branded hardware and software. There are more than 550 CNAs worldwide, and most are vendors covering their own products.

The cybersecurity news timeline: how Flock got here

August 2026: Flock publishes its vulnerability disclosure policy, including the section "How we assign and publish CVE identifiers" — effective starting September 2026. FLOCK'S POLICY
October 6, 2026: Flock announces on its blog that CISA has authorized it as a CVE Numbering Authority. CISO Chris Castaldo frames the move as a commitment to transparency and faster responses to researcher findings, plus an end to duplicate or conflicting entries. FLOCK'S POLICY
October 12, 2026: CyberScoop publishes its investigation: experts warn of a conflict of interest; Flock declines to answer questions or make an executive available for an interview. REPORTED
October 13, 2026: SC Media's brief notes some researchers plan to keep disclosing vulnerabilities independently rather than rely on Flock's records. REPORTED

What a CNA is — and what it is NOT

A CNA IS: an organization with a defined scope that can reserve CVE IDs, assign them to validated vulnerabilities, and publish official CVE records — without waiting for an outside party to do it. Flock says this lets it acknowledge researcher findings, coordinate disclosure timelines internally, and give researchers proper credit.
A CNA is NOT: a security certification, a quality stamp, or proof of impartiality. As CyberScoop's reporting makes clear, CNA authorization does not establish that a company's security practices are strong or that its vulnerability assessments will always be fair. The program's credibility runs entirely on the accuracy and detail of what each CNA publishes.

The conflict-of-interest case

Five facts that make experts uneasy EXPERT ANALYSIS

It grades its own flaws. Flock's scope covers its own branded hardware and software. Security experts warn a vendor may describe vulnerabilities in ways that downplay their impact — especially one whose customers are police departments and whose business is already contested.
The timeline is 120 days, not 90. Flock's policy publishes the CVE record when a fix is available — or after 120 days if no fix exists. Flock's stated reason: field-deployed hardware has longer release cycles than cloud software. It is longer than the 90-day window researchers are used to.
It can withhold publication on "safety risk" grounds. Flock's policy reserves the right to hold back a record if disclosure would, in its judgment, create a material safety risk to law enforcement or the public. Katie Moussouris of Luta Security told CyberScoop this clause could be abused to control CVEs — the fix, she argues, is timely, transparent, accurate disclosure with a customer-safety-first stance.
There is no paid bug bounty. Flock does not run a paid bug bounty program, and its policy restricts certain testing methods (live customer deployments, law enforcement data, physical attacks, denial-of-service testing, social engineering). Fewer paid incentives means fewer independent eyes.
It declined to be interviewed. CyberScoop reports Flock declined to answer questions or make an executive available for an interview, referring back to the blog post instead.

To be fair: many vendors hold CNA status for good reason, and CyberScoop's experts acknowledge that. The conflict-of-interest concern is not that Flock is a CNA — it is whether a surveillance vendor under scrutiny can be trusted to evaluate its own weaknesses. EXPERT ANALYSIS

The scrutiny context

REPORTED Flock makes automated license-plate readers and AI-powered cameras sold to law enforcement. CyberScoop and SC Media both report the company faces ongoing public and legal scrutiny over privacy concerns and reports of police misuse of its technology. Those controversies, experts say, cloud how researchers view Flock as a CNA — trust in a vulnerability record depends on trust in the author. No new incidents are alleged here; the point is the pre-existing trust deficit meeting a new self-grading power.

What to watch: the Moussouris test

Katie Moussouris (Luta Security), via CyberScoop: the measure of Flock as a CNA is whether its records give cities, police departments, and the public enough detail and accuracy to track specific risks — by product version, the nature of the vulnerability, and ideally how to mitigate or fix it. EXPERT ANALYSIS

Apply that test to every Flock CVE record you read:

Product version: does the record name the exact affected versions — not just "Flock cameras"?
Vulnerability type: is the weakness described precisely (e.g., improper authentication, injection) rather than in vague "security issue" language?
Mitigation: is there a fix, a workaround, or at minimum a clear statement that none exists?
Timeliness: was the record published promptly after validation — or held for the full 120 days?
Withholding transparency: if a record is delayed or withheld, is the safety-risk reasoning explained, as Flock's own policy promises?

Where Flock publishes advisories

Flock says its security advisories — current and historical, including CVE information — live at flocksafety.com/legal/security-advisories. CVE records are also available through the CVE List at cve.org and downstream databases such as the NVD. Because some researchers plan to disclose independently, cross-check Flock's records against researcher write-ups and the NVD before treating any single source as complete.

Featured platform — BreachHunter: Flock's story is a vulnerability-management story. When a vendor grades its own flaws, you need independent exposure validation — we built BreachHunter for exactly that: finding the weaknesses in your stack that someone else's disclosure timeline might delay.

Flock CVE authority FAQ

Can Flock really assign CVE IDs to its own products?

Yes. On October 6, 2026, CISA authorized Flock Safety as a CVE Numbering Authority. Its defined scope covers Flock-branded hardware and software products — meaning Flock can now assign CVE identifiers and publish the associated CVE records for vulnerabilities in its own products directly to the CVE catalog, instead of relying on outside parties to request IDs on its behalf.

Does CNA status mean Flock's security is certified?

No. Becoming a CVE Numbering Authority does not certify that a company's security practices are strong or that its vulnerability assessments will always be impartial. CNA status is an administrative role in the CVE Program — it authorizes ID assignment and record publication within a defined scope. The credibility of any CNA depends on the accuracy and detail of the records it publishes.

Why do experts worry about Flock as a CNA?

Security experts cited by CyberScoop note the conflict of interest: a vendor grading its own flaws while under public and legal scrutiny over law-enforcement misuse of its products. Specific concerns include Flock's 120-day disclosure timeline (longer than the usual 90), a policy clause reserving the right to withhold publication over a claimed safety risk, no paid bug bounty program, and Flock declining CyberScoop's interview questions.

What is Flock's vulnerability disclosure timeline?

Flock's published disclosure policy says it will publish the CVE record and advisory when a patch or mitigation is available — and if no fix is available within 120 days of validating the report, it will publish anyway, describing the issue and any available mitigations. The one exception: Flock may withhold publication if it judges disclosure would create a material safety risk to law enforcement or the public, in which case it says it will explain its reasoning to the reporter.

Where can I read Flock's security advisories?

Flock publishes advisories at flocksafety.com/legal/security-advisories. CVE records are also available through the CVE List at cve.org and downstream databases such as the NVD. Some researchers have said they plan to keep disclosing vulnerabilities independently rather than relying solely on Flock's records, so cross-checking sources is prudent.

Flock Can Now Issue CVEs for Its Own Products — A Cybersecurity News Check