A Global View of the CISA KEV Catalog: Prevalence and Remediation

• The Known Exploited Vulnerabilities (KEV) catalog, growing at 17 new vulnerabilities per month in 2023, is crucial for understanding and managing cybersecurity risks.
• The KEV catalog includes vulnerabilities with a Common Vulnerabilities and Exposures (CVE) ID, evidence of active exploitation, and available remediation methods.
• Key strategies for managing vulnerability include establishing clear responsibilities and authority for IT and cybersecurity teams, ensuring visibility across the environment, setting defined remediation timeframes based on vulnerability severity, and leveraging technology and automation for vulnerability assessment and remediation.

The Known Exploited Vulnerabilities (KEV) catalog, growing at 17 new vulnerabilities per month in 2023, is crucial for understanding and managing cybersecurity risks. KEVs are significantly more prevalent and resolved faster than other vulnerabilities, with 35% of organizations having at least one KEV in 2023. Despite this, meeting CISA’s remediation deadlines remains challenging, with only 40% of KEVs being remediated on time.

The KEV catalog includes vulnerabilities with a Common Vulnerabilities and Exposures (CVE) ID, evidence of active exploitation, and available remediation methods. CISA’s KEV catalog, created to address prioritization challenges in vulnerability management, emphasizes that known exploited vulnerabilities should be top remediation priorities. The catalog’s impact is evident, especially for U.S. federal agencies, which are 63% more likely to meet remediation deadlines due to binding directives from CISA.

Although KEVs are prevalent across industries and geographies, there are significant variations. Certain sectors, such as education and government, show higher rates of KEV presence. The study also reveals that KEVs are 2.6 times more prevalent than non-KEVs and that vulnerabilities used in ransomware campaigns are 64% more prevalent. This underscores the importance of focused remediation efforts on KEVs to mitigate risks effectively.

Key strategies for managing vulnerability include establishing clear responsibilities and authority for IT and cybersecurity teams, ensuring visibility across the environment, setting defined remediation timeframes based on vulnerability severity, and leveraging technology and automation for vulnerability assessment and remediation. Additionally, metrics and accountability are critical for tracking remediation progress and integrating vulnerability management into business operations and executive reporting.

Signup to read the full study