Researchers publish tool to enhance CISA KEV prioritization

A new paper offers an in-depth look at the CISA Known Exploited Vulnerability (KEV) catalog, providing a free tool to help security teams better manage and prioritize these vulnerabilities. The research, led by former CISA KEV Section Chief and current runZero VP of Security Research Tod Beardsley, applies various enrichment signals and exploit data to assist organizations in identifying the most critical threats, according to a recent report by The Cyber Express.

The paper reveals that only 32% of vulnerabilities in the CISA KEV catalog are immediately exploitable for initial access, challenging the common misconception that it lists the most severe flaws. Inclusion criteria for the KEV catalog are specific: a CVE identifier, a reasonable mitigation path, evidence of exploitation observed by CISA, and relevance to the U.S. Federal Civilian Executive Branch. The research also highlights that many KEV vulnerabilities are not remotely exploitable or require authentication. The accompanying tool, KEV Collider, allows users to explore and validate KEV enrichment data, integrating information from sources like CVSS, EPSS, SSVC, Metasploit, Nuclei, and MITRE ATT&CK mappings to aid in operational prioritization.

The findings underscore that achieving perfect vulnerability coverage is increasingly unrealistic for organizations facing resource constraints. The paper aims to help security practitioners navigate this uncertainty, enabling them to prioritize remediation efforts, detection strategies, and resource allocation more effectively.

Source: The Cyber Express