Match the target's component list and internet facing products against CISA's Known Exploited Vulnerabilities catalog, then ask which entries were present, when they were fixed and how long that took. KEV is a short list of flaws exploited in the wild, so any hit deserves a direct answer.
What KEV is
CISA describes the catalog as its authoritative source of vulnerabilities exploited in the wild. Each entry carries details such as the date added, a due date, recommended actions and whether ransomware use is known. CISA advises organisations to use KEV as an input to their vulnerability management prioritisation framework, which is a polite way of saying it is a signal, not the whole process.
Steps
- Get the inventory. Ask for an SBOM and a list of externally reachable products, appliances and SaaS the target runs. See our post on telling whether an SBOM is complete.
- Map to CVE identifiers. Scanner output usually lists them. Product names alone are not enough, because versions decide exposure.
- Compare with the catalog. The catalog can be downloaded in structured form, so this is a script, not a research project.
- Record three dates for each hit: when the vulnerability entered KEV, when the target fixed it, and when the target first knew.
- Ask what they do now. A good team has a rule for KEV entries that is stricter than its rule for other findings.
What a hit means and does not mean
| Finding | Reading |
|---|---|
| Component in KEV, fixed within days | Healthy process |
| Component in KEV, still present | Ask about compensating controls and exposure |
| KEV entry on a vendored or unscanned component | Scanning gap, not just a patch gap |
| No hits | Good, but check the inventory is complete |
An entry in KEV means the flaw has been exploited somewhere. It does not mean this target was exploited. Whether a specific installation is exposed depends on configuration and reachability, and a compromise assessment is a separate exercise.
Questions that separate teams
- Do you subscribe to KEV updates, and who reads them?
- What is your internal deadline for a KEV listed flaw in internet facing software?
- Can you show the last three cases from detection to deployed fix?
- How do you handle a KEV entry in a component you cannot patch yourself?
Do not accept "we patch quickly" as an answer. Ask for the three cases.
Try it yourself
Open the demo and watch how known vulnerabilities are tracked and prioritised across a portfolio. Look at how exploitation status changes the order of the queue.
Click through it at your own pace, or open it full screen.
Safeguard's vulnerability management and reachability analysis help teams decide which findings to fix first, and the free scan is a quick way to see your own list.
Quick check
Is a KEV hit a deal breaker?
Not by itself. The speed and quality of the response matter more than the presence of one entry.
Does KEV cover every exploited vulnerability?
No catalog can promise that. Treat it as one input alongside advisories and your own telemetry.
Sources
Last reviewed: 19 October 2026.
