Monitoring Changes in KEV List Can Guide Security Teams

Analysis presented at BSides Las Vegas warns that organizations relying on CISA's Known Exploited Vulnerabilities (KEV) catalog may miss silent updates that change the urgency of patching: the catalog lists over 1,140 exploited CVEs, and changes such as flipped ransomware flags, shortened remediation due dates, and the timing of updates (notably Fridays) should be treated as signals to reprioritize remediation efforts.