Yogesh is a PSIRT Manager at Red Hat, where he specializes in the organizational design of global vulnerability ecosystems. His talk is titled: “Designing the Hierarchy of Trust: Governance Lessons from a CVE Root and CNA-LR”
As the EU CRA establishes a continent-wide vulnerability infrastructure, the primary challenge is organizational: how to balance speed with sovereignty across thousands of vendors and national CSIRTs. The risk of creating a centralized bureaucratic bottleneck, a known hurdle for entities like MITRE, is high.
Yogesh propose a “Governance Blueprint” for GVIP and the EU, derived from Red Hat’s evolution from a CNA to a Root and CNA-of-Last-Resort (CNA-LR) within the CVE Program. We will explore “what works” and “what doesn’t work” in a federated model.
