The CISA KEV catalog lists 289 vendors, but nine of them account for 898 of the 1,748 entries (51%). At the other end, 149 vendors (52%) have a single entry each. Concentration helps you start, and the long tail is why a vendor watchlist alone leaves gaps.
Method
We downloaded the KEV JSON on 19 October 2026 (version 2026.10.16) and counted entries by the vendorProject field as CISA spells it. We ranked vendors by entry count and measured how many it takes to reach half of all entries. We did not merge vendors that are owned by one parent company, so a parent with several brand names appears as several vendors.
The top of the list
The nine largest vendors by entry count are:
| Vendor | Entries |
|---|---|
| Microsoft | 390 |
| Cisco | 101 |
| Apple | 95 |
| Adobe | 82 |
| 75 | |
| Oracle | 46 |
| Apache | 41 |
| Ivanti | 36 |
| Fortinet | 32 |
Together that is 898 entries, or 51% of the catalog. Next in order are Linux (31), Citrix (27), D-Link (26), VMware (26), SonicWall (19) and Synacor (19).
The long tail
Of the 289 vendors, 149 appear once. That is 8.5% of entries spread across more than half of the vendors. Entries in this tail are often from small products, appliances or open source projects that a team has never heard of until a feed names them.
Why this matters for a watchlist
A watchlist of the top nine vendors would cover half the catalog, and a list of the top 30 would cover more. But the rest comes from the tail, and you cannot predict which tail vendor will appear next. If your estate includes a niche appliance or a library from a small vendor, a vendor-name filter is only as good as your inventory of what you run.
So the better order is:
- Build the inventory of products, versions and dependencies first.
- Match the full catalog against it, not only the largest vendors.
- Review the unmatched high-profile vendors separately, in case you run a product under a name you did not expect (a managed service, for example).
One caution
Vendor spelling in the feed is not always consistent across products, and a vendor can appear under a parent name in one entry and a product brand in another. Counts by name are therefore a guide, and a few vendors may be split in ways we did not correct.
Safeguard's SBOM and dependency scanning lists the components you run, and reachability analysis helps separate vulnerable code your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.
Quick check
How many vendors are in the KEV catalog?
289 distinct vendor names in the version read on 19 October 2026, with 149 appearing once.
Is a top vendor watchlist enough?
It covers about half the entries. The rest need a match against your own inventory.
Sources
- CISA Known Exploited Vulnerabilities catalog, JSON read on 19 October 2026, catalog version 2026.10.16 (1,748 entries).
Last reviewed: 19 October 2026.
