Methodology
KEV Intelligence Methodology
How KEV Intelligence observes exploitation through proprietary sensors, attests evidence, scores confidence, enriches context, and delivers early warnings — including accepted evidence sources.
Pipeline
Observe → Attest → Score → Enrich → Operationalize → Deliver
KEV Intelligence is designed to help security teams move from vulnerability noise to exploitation signal. The workflow below describes how intelligence moves from raw sources to operational delivery.
Observe
Proprietary honeypots and sensors first, then vendor advisories, relevant public evidence, and CISA KEV context.
Attest
Validate exploitation evidence and source credibility before a CVE is treated as known exploited.
Score
Assign confidence based on source quality, specificity, telemetry, corroboration, and validation.
Enrich
Add EPSS, CVSS, CWE, timelines, PoCs, Nuclei, Metasploit, scanner context, online mentions, and product context.
Operationalize
Convert exploitation intelligence into detection context, request indicators, payload fingerprints, virtual patch guidance, and false-positive notes.
Deliver
Provide intelligence through UI, RSS, Pro API, and workflow-ready exports.
Definition
What Counts as a KEV?
A vulnerability is treated as a known exploited vulnerability when there is credible evidence of exploitation in the wild. KEV Intelligence leads with proprietary sensor and honeypot evidence, then corroborates with vendor advisories, official catalogs, and relevant public reporting.
When KEV Intelligence cites honeypot or sensor evidence as attestation, exploitation activity means an attempt to exploit a vulnerability, whether or not the target was actually vulnerable or the attempt succeeded. Sensor-derived KEV attestations reflect observed attempts mapped to a CVE — not proof that a specific organisation was compromised.
Valid attestation sources can include:
- KEV Intelligence honeypot and sensor evidence of exploitation attempts mapped to a CVE
- Vendor advisories that explicitly state active exploitation, observed attacks, or equivalent language
- Official known exploited vulnerability catalogs
- High-trust exploitation reporting and threat intelligence
- Credible public reporting that documents exploitation in the wild
KEV Intelligence does not treat a generic patch advisory, PoC release, scanner template, or exploitability claim alone as sufficient evidence of known exploitation.
Scoring
Confidence Scoring
KEV Intelligence assigns a confidence level to help teams prioritise faster. Levels are computed from attestation sources, exploitation status, and sensor telemetry. Rules may evolve as the product matures; per-CVE evidence is always shown on the CVE detail page.
Official catalog attestation, or a retained sensor observation with high confidence.
Exploitation confirmed by one or more reputable sources, including direct vendor advisories, but not yet observed in KEV Intelligence sensors.
Retained sensor observation explicitly tagged medium confidence.
Retained sensor observation explicitly tagged low confidence.
Inputs
How Confidence Scoring Works
Confidence scoring is how KEV Intelligence separates strong exploitation evidence from weak signals, so teams are not over-mapping random honeypot noise to a CVE. We weigh the following inputs when deciding how strongly a vulnerability is tied to real-world exploitation:
Source Quality
Authoritative sources (official exploited-vulnerability catalogs, vendor advisories stating exploitation, high-trust reporting) carry more weight than unverified or low-trust signals.
Endpoint Specificity
Activity targeting a CVE-specific endpoint or request path scores higher than generic scanning or product homepage probing.
Payload Fidelity
CVE-specific payload structures and known exploit fingerprints score higher than non-specific or ambiguous payloads.
Repeat Observations
Activity seen repeatedly, across time and from different sources, is stronger than a single low-fidelity request.
Sensor Telemetry
First-hand honeypot and sensor observations of exploitation attempts strengthen confidence when the activity is sufficiently CVE-specific.
Public Corroboration
Independent public reporting or advisories that corroborate the same exploitation raise confidence.
Human Validation
KEV Intelligence applies human review where needed for KEV Intelligence-attested entries, especially when automated signals are ambiguous.
When evidence is weak or mapping is uncertain, KEV Intelligence uses lower confidence and language such as "activity targeting endpoints associated with" or "consistent with exploitation of," rather than over-claiming. Per-CVE evidence is always shown on the CVE detail page.
Telemetry
Sensor Telemetry
KEV Intelligence uses proprietary honeypots and sensors to observe exploitation attempts against internet-facing services. Activity is mapped to CVEs where possible and reviewed for confidence.
Exploitation activity means an attempt to exploit a vulnerability, whether or not the target was actually vulnerable or the attempt succeeded. Event counts, charts, and telemetry on KEV Intelligence reflect this definition.
We describe observed exploitation attempts and activity consistent with exploitation — not confirmed compromise of a specific victim organisation unless separately documented by a credible source.
Aggregate telemetry charts and daily activity trends are available for the last 90 days. First and last observed timestamps reflect all-time sensor history. Raw per-event detail (attacker IPs, request paths, payloads) is retained for 30 days publicly and 90 days for Enterprise customers.
Review
False Positives and Review
Sensor mapping, automated enrichment, and high-volume public sources can produce noise. KEV Intelligence applies human review for KEV Intelligence-attested entries and uses confidence scoring to surface stronger signals first.
- Scanner-like or indiscriminate traffic may map to a CVE with lower confidence until corroborated.
- Vendor advisories without explicit exploitation language are not used as KEV attestation on their own.
- PoCs and scanner templates enrich context but do not by themselves establish known exploitation.
- Teams should validate exposure and relevance in their own environment before treating any signal as an immediate remediation mandate.
Limits
What KEV Intelligence Does Not Claim
- Complete coverage of every exploited vulnerability in the wild
- That every signal is always earlier than CISA KEV — we surface earlier signals when evidence supports it
- Replacement of CISA KEV or your vulnerability management programme
- Proof of compromise of a specific customer environment from sensor telemetry alone
- Prevention of breaches or guaranteed detection in your estate
CISA KEV is authoritative and valuable. KEV Intelligence complements it with proprietary sensor observations, confidence, inspectable evidence, RSS delivery, and automation-ready Pro API access.