By CyberScoop Staff
Published: October 2026

Main Facts

Flock Safety, a prominent and frequently controversial public safety technology vendor, has officially joined the global Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA). This designation grants the company the direct authority to discover, assign identification numbers to, and grade security vulnerabilities found within its own extensive product suite—which includes automated license plate readers (ALPRs), AI-powered surveillance cameras, and gunshot detection systems.

While Flock frames this milestone as a positive step toward operational efficiency and streamlined communication with security researchers, the decision has ignited a fierce debate across the cybersecurity community. Critics, privacy advocates, and vulnerability management experts argue that empowering a company dogged by controversies over law enforcement misuse, data privacy, and product security to "grade its own homework" introduces deep structural conflicts of interest.

The core friction points of Flock’s new CNA status include:

• Self-Policing Concerns: Flock now possesses the unilateral power to determine the severity and materiality of bugs discovered in its infrastructure.
• Physical Security Dismissals: Past disputes over whether vulnerabilities requiring physical access to street-side cameras constitute "material" risks have raised concerns about underreporting.
• Operational Transparency: Flock’s vulnerability disclosure policy includes provisions allowing the company to withhold information if it deems publication a risk to public safety or law enforcement operations.
• The Broader CNA Landscape: The situation highlights systemic vulnerabilities within the CVE framework itself, where oversight of participating vendor-CNAs varies wildly.

Chronology: The Lead-Up to Flock’s CNA Designation

To understand the weight of Flock’s integration into the CVE Program, it is necessary to examine the timeline of events leading up to its authorization and the preceding security challenges faced by the company:

• Late 2025: Security researchers identify and report multiple technical defects affecting Flock’s automated license-plate readers and gunshot detection units. Flock subsequently submits these findings to the National Vulnerability Database (NVD) but classifies them as non-material, arguing that the flaws necessitate physical access to the hardware to exploit. Security analysts push back, noting that the devices are mounted openly on public utility poles across cities nationwide.
• August 2026: In an effort to formalize its security posture, Flock publishes a comprehensive Vulnerability Disclosure Policy (VDP) outlining rules for ethical hackers, while explicitly barring testing on live customer deployments, social engineering, or physical tampering.
• September 2026: Flock launches a dedicated "Security Advisories" portal designed to house future vulnerability disclosures and patches. Around this same time, independent security researchers perform technical teardowns of stolen or leaked Flock software, further illuminating how the company’s architecture tracks vehicles and citizens.
• October 2026: Flock formally joins the international coalition of over 550 CNAs, gaining the independent mandate to assign CVE IDs to its own product portfolio.

Supporting Data and Technical Context

The CVE Program, sponsored by the Cybersecurity and Infrastructure Security Agency (CISA) and managed by the MITRE Corporation, relies on a decentralized network of organizations known as CNAs. These entities include software vendors, open-source projects, and research institutions tasked with ensuring that vulnerabilities are cataloged accurately and quickly.

However, the efficacy of the program heavily relies on the transparency and technical maturity of the individual CNA. According to security experts, the risks of vendor-led CNAs typically manifest in two ways:

1. Downplaying Severity: Immature or reputation-conscious vendors may intentionally or unintentionally assign lower severity scores to critical flaws to mitigate public relations fallout or stock drops.
2. Inconsistent Enforcement: The CVE framework lacks uniform operating standards across CNAs. While some corporate CNAs maintain hyper-active disclosure pipelines, others go years without publishing a single advisory.

Flock’s technical ecosystem compounds these structural challenges. Its hardware—consisting of solar-powered and grid-connected cameras—collects vast streams of location data utilized by thousands of police departments across the United States. Because these devices operate in public spaces, the boundary between "physical access" and "remote exploitability" becomes blurred. Critics note that treating physical accessibility as an automatic disqualifier for severity ignores the reality of street-side hardware tampering.

Furthermore, Flock’s explicit policy reservation—allowing the company to delay or withhold vulnerability disclosures if it believes transparency threatens law enforcement operations or public safety—sets a troubling precedent. Traditional CNAs generally prioritize technical accuracy and prompt disclosure to prompt defenders to patch systems before malicious actors weaponize the flaws.

Official Responses and Stakeholder Perspectives

Flock Safety has declined requests for live interviews regarding its new CNA status, choosing instead to rely on written statements and corporate blog posts.

In a statement announcing the move, Chris Castaldo, Chief Information Security Officer at Flock, emphasized the logistical benefits of the designation:

"It allows us to move faster when researchers report findings, eliminate confusion from duplicate or conflicting vulnerability entries, and give our customers a single, trusted source for security information about our products."

Security and privacy experts, however, have expressed profound skepticism. Katie Moussouris, founder and CEO of Luta Security—a leading authority on vulnerability disclosure and coordination—highlighted the unique pressures facing Flock:

"The measure of Flock as a CNA is whether its records give cities, police departments, and the public enough detail and accuracy to let people track specific risks by product version, the nature of the vulnerability, and ideally how to mitigate or fix it," Moussouris explained.

She further noted the inherent conflicts of interest:

"A vendor in the CNA role writes the description and often sets the severity score, so an immature vendor may inaccurately represent an issue, either through ignorance or in a misdirected effort to downplay it… Flock stands out as a CNA because its products track drivers’ movements, its customers are police, and its policy reserves the right to hold back publication if it decides disclosure would create a safety risk to law enforcement or the public."

Independent security and privacy researcher Zach Edwards echoed these concerns, pointing out that external researchers have frequently had to drag vulnerabilities into the light through independent analysis:

"These cameras sit on poles on public streets. Only time will tell how Flock operates their CVE program and if they issue CVEs for vulnerabilities publicly disclosed. But, if their recent history is any indication, they will probably screw it up in some epic way that somehow unites people across the United States to demand CVE issuing reform."

Edwards added that while numerous tech vendors serve as CNAs for their own codebases, Flock’s intersection with law enforcement surveillance, coupled with past friction between the company and independent hackers, makes its stewardship a high-stakes test case for the CVE program.

Broader Implications for the Security Industry

Flock’s integration into the CVE Program raises existential questions about the future of vulnerability management, corporate self-regulation, and public accountability.

1. The Trust Deficit in Surveillance Tech

Public safety and surveillance vendors operate under a different societal microscope than traditional enterprise software companies. Because their tools are integrated directly into municipal policing and infrastructure—frequently without comprehensive public consent or robust legislative oversight—any compromise in their software supply chain carries severe civil liberties implications. If Flock underreports or obscures vulnerabilities, cities and citizens remain blind to backdoors or exploit vectors that could be leveraged by sophisticated threat actors to intercept mass surveillance feeds.

2. Stress-Testing the CVE Program

The CNA model assumes a baseline level of organizational maturity and good-faith adherence to vulnerability disclosure norms. When a company with a history of defensive public relations or legal pushback against security researchers is granted CNA status, it tests the institutional boundaries of CISA and MITRE’s oversight mechanisms. If a vendor chooses to weaponize its CNA authority to suppress embarrassing security flaws or delay patches under the guise of "public safety," the credibility of the entire CVE database risks dilution.

3. The Path Forward for Independent Researchers

Independent hackers and security analysts who have historically exposed flaws in Flock’s automated license plate readers and data pipelines now face a more complex playing field. With Flock acting as the official gatekeeper of its own vulnerability metrics, external findings may face bureaucratic friction, disputed severity ratings, or outright suppression. Consequently, many researchers have signaled their intent to continue independent disclosures outside of Flock’s ecosystem, ensuring that transparency remains driven by the community rather than the corporation.

As Flock Safety begins issuing its first wave of CVEs under its new authority, the eyes of the global cybersecurity community will be firmly fixed on its output. Whether the company can rise to the standard of transparent, rigorous vulnerability management—or whether its tenure fuels a nationwide push for CVE program reform—remains one of the most critical governance battles in modern tech security.