Keep a watchlist of the vendors and products you run, check CISA's Known Exploited Vulnerabilities feed on a schedule, and open a task when a listed entry matches. This gives you ongoing monitoring for exploitation at almost no cost, and it complements annual reviews.
What you are watching for
CISA describes the KEV catalog as the authoritative source of vulnerabilities exploited in the wild and recommends using it as an input to prioritization. It is published in CSV and JSON, and each entry has a date added and a due date. That makes it easy to compare against a list of your own products.
Setting it up
- Build the watchlist. For each vendor in your register, list the exact product names and versions you use. Include older brand names.
- Pick the feed. Use the JSON or CSV file from the CISA catalog page.
- Schedule a check. Daily is easy to automate and weekly may be enough for low tiers.
- Match on vendor and product. Alert on any new entry that matches a row.
- Triage each match. Do you run the affected version? Is it internet facing? Has the vendor released a fix?
- Record the outcome in the vendor's row: fixed on date, workaround applied or accepted.
A triage table
| Question | If yes | If no |
|---|---|---|
| Do we run the affected product and version? | Continue | Note and close |
| Is it reachable from the internet? | Treat as urgent | Still patch, with a normal priority |
| Is a fix or mitigation available? | Apply it and verify | Ask the vendor for guidance and isolate the system |
| Do other vendors depend on the same component? | Check them too | Close |
What this does not cover
The feed lists vulnerabilities with confirmed exploitation, so it will miss issues that are serious but not yet exploited. It also does not tell you about a vendor's breaches, ownership changes or loss of certifications. Pair it with a few other signals:
- Vendor security advisories and release notes
- News of incidents at the vendor
- Changes to the vendor's trust page or subprocessor list
- Your own scanning of the software you run
For the broader question of how monitoring compares with periodic review, see continuous vendor monitoring versus annual review.
Try it yourself
Open the continuous monitoring demo and watch how a change is detected and surfaced after the first scan, then think about which of your vendors would warrant the same treatment.
Click through it at your own pace, or open it full screen.
Quick check
How often should I check the feed?
Daily if you can automate it. Weekly can work for vendors you tier low, as long as critical ones are checked more often.
What if a match is for a hosted service?
The vendor patches on their side, so ask them for the fix date and any customer impact, and record their answer.
Safeguard's zero-day discovery and continuous SBOM and dependency scanning can watch the software you run, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
