What CISA KEV Is and Isn’t – and a Tool to Help Guide Security Teams

The runZero paper and accompanying KEV Collider tool analyze CISA's Known Exploited Vulnerability (KEV) catalog, showing that only about one-third of KEV entries enable immediate initial access, that many KEVs have Metasploit or Nuclei modules available, and that enrichment signals (CVSS, EPSS, SSVC, MITRE ATT&CK mappings) can help security teams prioritize remediation and detection when perfect coverage is unrealistic.