Field notes
One useful thing a day about what is exposed and what to fix first.
Exploited this week, the control explained, one computed number, the misread, and the method. Every figure is read at source or computed from the public data, and the source is under each note.
69,615 CVEs published this year. About one in 450 is known exploited.
283 vendors appear in the KEV catalogue. 77% of entries are not Microsoft.
A local vulnerability is not a low priority one
91 added to KEV since July. 15 are tools that build or run software.
An accepted risk needs an owner and an expiry date.
Your remediation policy is the standard you will be assessed against.
Control 2405: patching has a clock, and you set it.
One in five known-exploited vulnerabilities has fed ransomware.
34 added to KEV in September. The most of any month this year.
Authentication failures doubled their share of KEV additions in 2026.
Eight added to KEV last week. Five are network appliances.
Three inputs to prioritisation are public. One is yours.
61% of all CVEs score under 1% on EPSS. It is a probability, not a severity.
Control 2402: monthly is fixed, the timeline is yours.
Three days. CISA set that deadline 102 times this year.
56% of known-exploited CVEs were already old when they were added.
DCC Level 0 is three controls. Level 1 is 101.