Decide ahead of time. A small on-call rota should receive only the alerts that justify weekend action: confirmed exploitation of something you run and expose. Give that person written authority for a short list of safe actions, so a Friday night alert does not wait for a manager.
Why weekends matter
The CISA KEV catalog assigns each entry a due date, and the page shows entries with due dates only a few days after the date added. Entries are added on whatever day CISA publishes them. Attackers also do not observe office hours. If your only response path starts on Monday, the first hours of exposure are unmanaged.
Define the weekend trigger narrowly
A weekend page should be rare. Use all of these conditions together.
- The vulnerability is confirmed exploited, for example by a KEV entry.
- The affected component is deployed in something internet reachable.
- No existing mitigation covers it.
Anything else waits for the next working day. If this produces pages every weekend, the trigger is too broad or your exposure is too large, and both are worth knowing.
Pre-approve a list of actions
A person who must ask permission at midnight will usually wait. Give the on-call engineer a written list of actions they may take alone.
| Action | Typical limit |
|---|---|
| Block a path or port at the edge | Reversible, logged |
| Disable an optional feature by flag | Reversible, logged |
| Roll back to a previous release | If previous version is not affected |
| Rotate exposed credentials | Always allowed |
| Take a service offline | Needs a named approver, and a phone number |
Keep the list short and review it twice a year.
Make handoffs explicit
On Monday morning, the on-call person should hand over a short written note: what fired, what was done, what is still open. Put it in the ticket, not in a chat thread that scrolls away.
Cover the vendor side too
Third party products you run have their own advisories. Make sure someone owns watching them, and that your contact details are current with each vendor so you receive their notices.
Test the path
Run a drill once a quarter with a fake alert on a Friday afternoon. Time how long it takes for a human to acknowledge. If the answer surprises you, fix the path before a real event does.
Related: build an alert ownership map.
Where Safeguard fits
Safeguard's policies can mark which findings are reachable and deployed, which is the input for a narrow weekend trigger. A free scan shows how findings are listed.
Quick check
Do all critical CVEs deserve a weekend page?
No. Page only for confirmed exploitation of something you run and expose.
What if we are too small for an on-call rota?
Use a shared inbox with a phone alert for the KEV and exposure condition only, and name a primary and a backup.
Sources
Last reviewed: 19 October 2026.
