Known Exploited Vulnerabilities catalog (KEV)

The Known Exploited Vulnerabilities catalog is a list published by the US Cybersecurity and Infrastructure Security Agency since November 2021. It does not record every known flaw, of which tens of thousands appear each year, but only those whose actual exploitation by attackers is established, that have a public identifier and a clear remediation. A binding operational directive requires US federal agencies to fix them within set deadlines, two weeks for the most recent. Its value for insurance lies in an observation: a flaw's theoretical severity score predicts real risk poorly, whereas confirmed exploitation predicts it well. The catalog therefore offers a simple, verifiable criterion for prioritizing patches, which insurers adopt in their applications, their alerts to insureds and sometimes their unpatched vulnerability exclusions. An insured exposed on the internet to an unpatched catalog flaw presents a risk the underwriter can measure from outside, without relying on its declarations.