Digital sovereignty is often discussed in terms of cloud infrastructure, data hosting, or dependence on large technology providers. But there is a more uncomfortable question when it comes to cybersecurity: who owns vulnerability data?

Who controls the infrastructure, identifiers, databases, enrichment, and models that we rely on to understand vulnerabilities? Organizations such as MITRE, CISA and CVE Program provide critical public infrastructure for the cybersecurity ecosystem, but how much of our vulnerability intelligence ultimately depends on external organizations and services?

Vulnerability information is a fundamental building block of cybersecurity, yet organizations increasingly depend on external platforms, proprietary databases, closed scoring systems, and AI services to collect, enrich, and interpret it.

This talk explores what digital sovereignty can mean for vulnerability intelligence. Using the open-source Vulnerability-Lookup ecosystem as a case study, we will look at open vulnerability data, GCVE, decentralized sources, and open AI models and datasets developed with VulnTrain. The goal is to examine what it takes to build a security intelligence stack that can be independently operated, understood, reproduced, and extended.

The central question is simple: can we build vulnerability intelligence that we can actually own?