Discover the Hidden Vulnerability Intelligence within CISA's KEV Catalog

Glenn Thorpe, who leads the security research team at GreyNoise, examines the Known Exploited Vulnerabilities catalog that CISA built for federal agencies but that many organizations now use as a reference. He opens with the basics: the entry criteria, the fact that the catalog records exploitation that has already happened rather than predicting it, and the remediation deadlines attached to each entry. He notes that five vendors account for about half of the entries and that most vendors appeared in the first year.

The middle of the talk splits the data into three groups: the initial November 2021 batch, a large burst of additions tied to the start of the Russia-Ukraine invasion, and everything else. That burst skews the average age, which makes the headline figure of roughly a thousand days misleading. Using 2023 as the first clean baseline year, he shows that newly added entries are increasingly recent, suggesting exploitation is being disclosed and acted on faster. CVSS scores look nearly identical across the groups, so they offer little help for ranking.

The more useful signals sit in the catalog's fields. The known ransomware campaign use flag is updated silently and only moves from unknown to known, and he found dozens of changes by harvesting the data daily and comparing it. Time-to-fix values, which shifted toward shorter windows over time, and the weekday an entry was added can also hint at urgency. Practitioners should recheck the fields they rely on and treat the catalog as prioritization context rather than a prediction tool.