What did Flock Safety get?
CyberScoop reported that Flock Safety joined the CVE Program as a CVE Numbering Authority, or CNA. That gives the company authority to assign CVE IDs to vulnerabilities in its own products and to grade those defects. The products include automated license plate readers and AI-powered cameras.
CyberScoop published the report on October 12, 2026. The article doesn't say when Flock received the authority.
Why does Flock say it wants this?
Flock says the role lets it assess and prioritize vulnerability responses internally. Chris Castaldo, the company's chief information security officer, said in a statement that it should help Flock move faster when researchers report problems and cut down on duplicate or conflicting entries. He also said it gives customers a single source for security information.
The article notes that many vendors hold CNA authority for good reasons. Flock is one of more than 550 CNAs, according to the article.
Can a company be trusted to grade its own flaws?
Security researchers quoted in the article weigh the question differently.
- Katie Moussouris of Luta Security says a vendor can be a good CNA for its own products if it keeps accurate records and ties each record to affected versions and fixes.
- She warns that trouble starts when a vendor lacks the maturity to assess its flaws, because the vendor writes the description and often sets the severity score.
- Zach Edwards, a security and privacy researcher, says CNAs are in effect grading their own work. He also says many vendors, including some with similar products, already hold the role.
Flock's disclosure policy bars testing against live customer deployments and accessing law enforcement or investigative data. It also bars physical attacks, denial-of-service testing and social engineering. The company doesn't run a paid bug bounty. The policy reserves the right to hold back publication if disclosure would create a safety risk to law enforcement or the public, which Moussouris called a possible route to abuse.
Flock declined to answer questions or make an executive available for an interview.
What changes for drivers?
The article doesn't describe any change to where Flock cameras are installed or how they operate. The CNA role concerns how the company records and communicates security flaws. Based on this report, it doesn't by itself remove or switch on any camera.
What happens next?
Flock published its vulnerability disclosure policy in August. It recently created a security advisories page, where it says it will publish all newly discovered and confirmed vulnerabilities going forward. That page is the place to check whether the CVE role leads to public records.
Edwards said only time will show whether Flock issues CVEs for vulnerabilities that have already been publicly disclosed. He also expects some researchers to keep reporting Flock flaws without coordinating with the company.
If you know where a Flock camera is, you can add it to the camera map, and how plate readers work explains what the cameras record. You can also send us a camera location or a correction.