About

About KEV Intelligence

Security practitioners building sensor-led early warning — from proprietary honeypot telemetry and inspectable evidence to automation-ready delivery.

Purpose

Our Mission

KEV Intelligence warns security teams when vulnerabilities move into credible real-world exploitation.

We use proprietary sensors and private honeypots to observe exploitation attempts, corroborate those signals with vendor advisories and relevant public evidence, and deliver confidence and defensive context so teams can act sooner.

CISA KEV is an essential baseline. KEV Intelligence complements it with first-hand telemetry, earlier signals where timestamps support them, and automation-ready delivery through the UI, RSS, and API — so teams can move from vulnerability noise to exploitation warning.

Observe

Proprietary honeypots and sensors first, then vendor advisories, public reporting, and CISA KEV context.

Attest

Validate exploitation evidence and source credibility before a CVE is treated as a KEV.

Enrich

Add confidence, timelines, EPSS, CVSS, CWE, PoCs, scanner context, and available sensor telemetry.

Deliver

UI, RSS, JSON, and Pro API for operational security workflows.

Team

Founder

Ryan Dewhurst

Ryan Dewhurst

Founder

Cybersecurity professional with experience across offensive security, threat intelligence, vulnerability research, and deception operations.

His work focuses on how attackers operate in the real world — tracking exploitation activity and vulnerability trends, and building and operating honeypots that capture attacker behavior, tooling, and tradecraft.

He is especially interested in the intersection of AI, vulnerability intelligence, exposure management, and real-world exploitation: observing when vulnerabilities move into active exploitation, prioritizing response with evidence, and using attacker telemetry to improve detection and mitigation.

Over the years he has worked across offensive security research, open source security projects, vulnerability intelligence, and technical leadership roles.

He is also known as the creator of Damn Vulnerable Web Application (DVWA) and WPScan (acquired in 2021).