Making the CISA KEV actionable for real-world risk

This piece introduces two resources—KEVology, a report analyzing how KEV entries behave across exploits, scores, and timelines, and KEV Collider, a runZero-hosted web app/dataset—to help defenders treat CISA’s KEV as an operational signal rather than a universal patch list. It emphasizes that no single metric (CVSS, EPSS, SSVC, or mere exploit existence) can prioritize risk in all contexts; instead, it advocates combining signals and paying attention to timing to distinguish theoretical risk from active, high-impact situations. The goal is to enable evidence-based, testable prioritization and experimentation aligned to each environment’s realities.