usefulness to the storage of vulnerability data, but not its active exchange among
automated systems; the CD&R Group researchers also claim that OVAL is more
appropriately categorized as an exchange format for penetration testing data rather
than vulnerability data. As of 2006, MITRE reportedly agreed with NISCC’s position