For years, the United States federal government's Known Exploited Vulnerabilities (KEV) Catalog has served as an essential operational anchor for vulnerability management. Despite its authority, the cybersecurity community has wrestled with a frustrating structural bottleneck: the catalog has traditionally operated as a trailing indicator. US, DHS CISA had to privately validate in-the-wild exploitation before publishing, occasionally warning network defenders’ days or weeks after threat actors
