You can test recall against the CISA Known Exploited Vulnerabilities catalog. Choose catalog entries that affect software you run, confirm a vulnerable version is present in a test, and check that your scanner reports it. Misses show a gap in advisory coverage that a normal clean report would hide.
What the catalog is
CISA describes the KEV catalog as the authoritative source of vulnerabilities that have been exploited in the wild, and says organizations should use it as an input to their vulnerability management prioritization. At the time of writing, the catalog page showed 1,748 entries, with recent additions dated mid October 2026.
That makes it a convenient, public, concrete list of flaws that matter. It is also a small list compared with all known CVEs, so recall against it is a narrow test, not a full measure.
A recall test in five steps
- Pick a sample. Download the catalog and choose ten to twenty entries for products or libraries you actually use. Include a mix of ecosystems.
- Build test fixtures. For each, create a small project, image or manifest that pins a version the CVE affects. Confirm the affected range from the vendor or advisory record yourself.
- Scan. Run your tool on each fixture with current data.
- Score. Record found, found under a different ID, or missed.
- Investigate misses. Is there an advisory record for the package at all? If the CVE is in an operating system component or a network device, a dependency scanner is the wrong tool, and that is a coverage fact worth writing down.
Calculate the share found out of the sample, and keep the fixtures as a regression suite. The method is the same one described in how to test a scanner for missed vulnerabilities.
Reading the result honestly
- A high hit rate on KEV samples does not prove high recall overall. It shows the most visible flaws are covered.
- A miss may be a scope limit and not a defect, for example a hardware product the tool never claimed to cover.
- Small samples are noisy. Report counts, not just percentages.
- Re-run after the vendor updates, and note the date.
KEV can also drive urgency in day to day work. See using KEV as a trigger for an urgent rescan.
What to ask a vendor
- How quickly are KEV additions reflected in your data?
- Which KEV entries fall outside your detection scope, by category?
- Can I flag KEV listed findings in policy and in the report?
Safeguard's zero-day discovery and dependency scanning feed a view of newly relevant issues, and the free scan is at https://gold.safeguard.sh/scan.
Try it yourself
Open the zero-day watch demo and see how a newly relevant issue is surfaced against your inventory.
Click through it at your own pace, or open it full screen.
Quick check
Is KEV a complete list of vulnerabilities?
No. It lists vulnerabilities known to be exploited, which is a subset, so it is a narrow recall check.
If my scanner misses a KEV entry, is it broken?
Not necessarily. The product may be out of its scope, such as firmware. Record it as a coverage fact and cover it another way.
Sources
Last reviewed: 19 October 2026.
