# Why Wait 90 Days for NVD? I Built a System That Creates CVEs Instantly.

tags: security, ai, cybersecurity, n8n I won a dev.to challenge last August by building something I desperately needed: an automated threat intelligence system that doesn't drown your team in noise. But this article isn't about winning. It's about what I learned building SOC-CERT — and why every developer should think differently about security automation in 2025. The Problem Nobody Talks About Most security advice stops at "keep your dependencies updated, run a static scanner." That's necessary but nowhere near enough. Here's the real problem: NVD publishes CVEs 30 to 90 days after a vulnerability is discovered. That gap is your exposure window. You're running dependencies with known exploits, and the official database hasn't catalogued them yet. Meanwhile, your security team — if you even have one — is drowning in alerts from 5 different feeds, all reporting the same CVE with slightly different formatting. Alert fatigue sets in. Things get missed. I built SOC-CERT to fix exactly this