Report known exploited vulnerabilities as three things: how many entries from the CISA Known Exploited Vulnerabilities catalog are present in your software right now, how long each one has been open, and which are still unresolved with an owner. Exploitation in the wild is the strongest signal leaders can act on.
What KEV is
CISA describes its catalog as the authoritative source of vulnerabilities that have been exploited in the wild, and positions it as an input to vulnerability prioritisation. Each entry carries the vendor and product, CVE identifier, a description, the related weakness category, whether it is known to be used in ransomware campaigns, the date added, a due date and a required action.
The due date and required action apply to US federal agencies under CISA directives. The earlier directive, BOD 22-01, is marked on CISA's site as superseded by BOD 26-04. A private company is not bound by it, but the due dates still make a handy reference point for your own targets.
The three numbers
| Number | Definition | Why leaders care |
|---|---|---|
| KEV present | Count of distinct KEV CVEs found in your assets | Direct exposure to active exploitation |
| KEV age | Days from the catalog add date (or your detection date) to closure, median and oldest open | Shows how fast you react |
| KEV open past target | Count beyond your internal target | The decision list |
Choose one clock start and say which. Using the date added to the catalog is easy to audit. Using your first detection date is fairer when a CVE entered your estate later.
Steps
- Match your component inventory against the catalog daily. An SBOM gives you the component list, and matching on CVE is mechanical.
- Confirm presence, not just the name. A product being listed does not mean your version or configuration is affected.
- Check reachability and exposure to rank within the KEV set.
- Assign an owner and a due date to each.
- Report the open list by name, each with its owner.
What to say about zero
Zero KEV findings can mean zero exposure or zero coverage. State the coverage beside it: the share of assets and repositories that were matched. A zero over ten percent of the estate is not good news.
Avoid
Do not blend KEV with all critical findings into one headline. Keep KEV as its own line, because it answers a different question: is anyone using this against others right now.
Try it yourself
Open the demo and look at how a zero day feed surfaces a newly relevant issue. Consider how you would add it to the weekly KEV list.
Click through it at your own pace, or open it full screen.
Safeguard supports this with SBOM and dependency scanning plus zero-day discovery, and you can run a free scan at gold.safeguard.sh/scan.
Quick check
Do private companies have to follow KEV due dates?
The directives apply to US federal agencies. Others can use the dates as a benchmark if they choose.
Is a KEV entry always a problem for me?
Only if your version and configuration are affected. Confirm presence first.
Sources
Last reviewed: 19 October 2026.
