Glossary
Known Exploited Vulnerabilities (KEV)
CISA’s catalog of vulnerabilities that attackers are actively exploiting, used to decide what to patch first.
Also called CISA KEV catalog.
In plain terms
There are tens of thousands of published vulnerabilities each year, and most are never exploited. The KEV catalog lists the ones that are, which makes it one of the best signals for what to fix first.
U.S. federal agencies must patch catalog entries by set deadlines, and many companies follow the same approach. CollectSEA pulls the catalog every two hours.
See what happens without it
The failure pattern this protects against, known vulnerability left unremediated, played out step by step.
Scroll the diagram sideways to see every system.
A known, fixable flaw becomes a breach.
What goes wrong:
- A fix for a critical flaw is published.
- One server running it is not in any inventory, so nobody patches it.
- Months later, attackers scanning the internet find it.
- A known, fixable flaw becomes a breach.
With the safeguard:
- A fix for a critical flaw is published.
- Every running component is inventoried with an owner and a deadline.
- The patch is applied before the deadline.
- The scan finds nothing to exploit.
When it mattered
In 2023 a SQL injection flaw in MOVEit Transfer was exploited at scale by the CL0P ransomware group, hitting hundreds of organizations through one file-transfer product.