On May 30, 2023, Cl0p ransomware operators began exploiting a SQL injection vulnerability in MOVEit Transfer, a widely used managed file transfer application. The vulnerability, later assigned CVE-2023-34362, had not been publicly disclosed when exploitation began. Within days, Cl0p had compromised hundreds of organisations using the software. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 2, 2023, and Progress Software published patches. But organisations that patched only after the KEV entry appeared had already had their data exfiltrated. The incident illustrates the fundamental challenge of vulnerability intelligence: the gap between vulnerability existence and public disclosure is the window when defenders are most exposed.
Vulnerability intelligence, the discipline of tracking, assessing, and prioritising security vulnerabilities to inform patching and defensive decisions, has been transformed by three developments in recent years. CISA's KEV catalog has created an authoritative, government-maintained list of vulnerabilities with confirmed active exploitation. The Exploit Prediction Scoring System (EPSS) provides a probabilistic assessment of exploitation likelihood that supplements but does not replace traditional severity scoring. And the market for zero-day exploits, documented through public disclosures and dark web intelligence, has created a category of vulnerability intelligence that requires proactive monitoring rather than reactive response.
CISA launched the Known Exploited Vulnerabilities catalog in November 2021 as a binding operational directive for US federal civilian executive branch agencies, requiring them to remediate listed vulnerabilities within specified timeframes. The catalog has since become a reference standard for the broader security community. Unlike the National Vulnerability Database (NVD), which lists all disclosed vulnerabilities regardless of exploitation status, the KEV catalog lists only vulnerabilities with confirmed active exploitation in the wild.
The KEV catalog's value for defenders comes from this confirmation of active exploitation. NVD lists tens of thousands of vulnerabilities, and traditional CVSS severity scoring assigns high or critical scores to a substantial fraction of them. But the vast majority of high and critical CVEs are never actively exploited. Prioritising all high and critical CVEs for immediate remediation is operationally impossible for most organisations. The KEV catalog provides a smaller, confirmed-exploitation list that represents the vulnerabilities that defenders demonstrably need to address, based on evidence of real-world attacker activity rather than theoretical severity.
For organisations outside the US federal government, the KEV catalog represents a strongly evidence-based prioritisation input that should be integrated into vulnerability management workflows. A vulnerability appearing in the KEV catalog should typically be treated as requiring immediate remediation ahead of other vulnerabilities at the same CVSS severity level, because the KEV entry confirms that attackers are actively using it rather than that it theoretically could be used.
The Exploit Prediction Scoring System, maintained by FIRST (Forum of Incident Response and Security Teams) and updated daily, uses machine learning to estimate the probability that a given CVE will be exploited in the wild within the next 30 days. The EPSS model is trained on data about past exploitation and incorporates features including the vulnerability's CVSS score, whether exploit code is publicly available, the affected software's market share, and signals from threat intelligence sources.
The EPSS score complements rather than replaces CVSS severity scoring. A high CVSS score indicates theoretical severity; a high EPSS score indicates demonstrated exploitation likelihood. The most concerning vulnerabilities from a risk management perspective are those with both high CVSS severity and high EPSS exploitation probability. But EPSS also surfaces lower-severity vulnerabilities that are being actively exploited, which would be deprioritised under a CVSS-only approach despite representing an immediate threat.
Research by FIRST using historical data has shown that EPSS-informed prioritisation significantly outperforms CVSS-only prioritisation in terms of the proportion of exploited vulnerabilities addressed per unit of remediation effort. This efficiency gain is particularly valuable for organisations with large vulnerability backlogs and limited patching bandwidth.
Zero-day vulnerabilities, security flaws that are being exploited before the vendor is aware of them or before a patch is available, represent the category of vulnerability intelligence that is hardest to operationalise but most important to monitor. By definition, zero-day vulnerabilities do not appear in vulnerability databases until after public disclosure, and the patches that enable traditional vulnerability management workflows do not yet exist. Defenders who wait for CVE assignment and patch availability are operating reactively, after exploitation has already begun.
Intelligence about zero-day vulnerabilities comes from several sources. Security researchers who discover vulnerabilities may publish limited technical details that signal exploitation in progress before full disclosure. Dark web markets that broker zero-day exploits occasionally surface new vulnerabilities through listings, though the highest-value zero-days are sold in private channels that are difficult to monitor. Anomalous exploitation patterns observed in honeypots or threat intelligence feeds may indicate zero-day exploitation before a vulnerability is formally identified.
The commercial market for zero-day exploits has been documented through public disclosures and investigative reporting. Brokers including Zerodium have published public acquisition price lists that reflect the market value of zero-day exploits for various platforms: iOS exploits have commanded prices exceeding one million dollars, reflecting both the difficulty of finding exploitable vulnerabilities in heavily-hardened platforms and the value of persistent access to iOS devices for surveillance purposes. While these high-value exploits are typically sold to government customers, their existence demonstrates that zero-day vulnerabilities for widely-used platforms are commercially available to motivated adversaries.
An effective vulnerability intelligence programme integrates multiple data sources into a workflow that connects vulnerability information to actionable remediation priorities. The NVD provides the baseline inventory of disclosed vulnerabilities. The KEV catalog provides confirmed-exploitation prioritisation. EPSS provides probability-based prioritisation for the broader vulnerability set. And dark web intelligence and security research feeds provide early warning of exploitation before formal disclosure.
The integration of vulnerability intelligence with asset inventory is the link that makes vulnerability data actionable. Knowing that CVE-2023-34362 affects MOVEit Transfer is valuable only if you know whether your organisation runs MOVEit Transfer, in which version, and with which network exposure. Vulnerability intelligence without asset context produces alerts that cannot be triaged; asset context without vulnerability intelligence produces an inventory that cannot be prioritised. The combination of the two, connecting vulnerability data to the specific software versions running in your environment, is what enables risk-based vulnerability management.
For external attack surface management, vulnerability intelligence has a specific application: understanding which of your externally exposed services are running software with known exploited vulnerabilities. A web application running an unpatched version of a widely-used framework that appears in the KEV catalog is an immediate priority, because it represents a confirmed exploitation path that is externally accessible. Defendis continuously monitors external exposure for exactly this combination of confirmed exploitation and external accessibility, surfacing the specific vulnerabilities that represent the highest actual risk based on your organisation's exposure profile.
The practical implementation of vulnerability intelligence in a security programme requires integrating data feeds, establishing triage criteria, and connecting intelligence outputs to remediation workflows. Without this operational structure, vulnerability intelligence data accumulates without producing prioritised action, and the programme fails to deliver the risk reduction it is designed to achieve.
The starting point for a vulnerability intelligence workflow is defining the asset scope: which systems and software versions are in scope for vulnerability tracking, and what is the source of truth for this inventory? Asset inventory is a persistent challenge for most organisations because the infrastructure changes continuously: new systems are deployed, software is updated, cloud resources are provisioned and deprovisioned. A vulnerability intelligence programme is only as good as the asset inventory it works from, and organisations with poor asset visibility cannot effectively prioritise vulnerabilities because they cannot assess which vulnerabilities affect their specific environment.
Once asset scope is defined, vulnerability feeds can be mapped to asset inventory to produce a prioritised list of relevant vulnerabilities. The triage criteria for this prioritisation should incorporate CVSS severity, KEV status, EPSS score, and environmental factors including the external accessibility of the affected system and the sensitivity of the data it processes. A high-severity vulnerability in an externally accessible system processing sensitive customer data warrants a shorter remediation timeline than the same vulnerability in an internal development server with no internet exposure.
The output of the triage process should feed directly into ticketing and change management workflows that track remediation status and escalate overdue items. Vulnerability intelligence that is assessed and prioritised but does not produce remediation tickets with owners and deadlines has limited operational value. The connection between intelligence assessment and remediation execution is where many programmes lose effectiveness, making the integration between vulnerability intelligence tools and ITSM platforms a critical infrastructure investment for mature programmes.
Defendis enriches vulnerability intelligence with external attack surface context, showing which of your externally exposed services are affected by KEV-listed or high-EPSS vulnerabilities and providing early warning of exploit availability through dark web monitoring before vulnerabilities reach public disclosure. This external context transforms vulnerability intelligence from a reactive patch management exercise into a proactive risk reduction programme.
The lifecycle of a zero-day vulnerability from discovery to patch creates a period of irreducible risk for defenders. A zero-day by definition is a vulnerability for which no patch exists; the only defensive options during this period are compensating controls, such as disabling the vulnerable feature, deploying an intrusion detection rule for known exploitation patterns, or isolating the vulnerable system from higher-risk network segments. The quality of available zero-day intelligence determines how quickly defenders can identify and implement these compensating controls after exploitation begins.
Zero-day intelligence comes from several sources. Vulnerability research organisations, including government agencies like the NSA and GCHQ, commercial vulnerability research firms, and academic researchers, discover vulnerabilities through code auditing, fuzzing, and dynamic analysis. When these vulnerabilities are discovered, the researcher or organisation must decide whether to report them to the vendor for coordinated disclosure, retain them for offensive use, or sell them on commercial or government vulnerability markets. The tension between coordinated disclosure norms and the commercial and strategic value of unreleased vulnerabilities shapes the timeline between discovery and patch availability for high-value targets.
Dark web and criminal intelligence about zero-day availability is a specialised intelligence collection area. When an exploit for a specific zero-day is offered for sale on criminal forums, this is a significant intelligence signal: it indicates that at least one criminal actor has the capability to exploit the vulnerability, that the vulnerability is considered sufficiently valuable to monetise, and that the exploit may soon be in the hands of multiple actors who purchased it. Detecting these offerings before they produce publicly observable exploitation events allows defenders to proactively assess their exposure to the specific vulnerability and prioritise compensating controls before the broader attack wave. This criminal market intelligence, combined with external attack surface visibility, creates the earliest possible warning for zero-day exploitation risks.
The CISA Known Exploited Vulnerabilities catalog is a list of vulnerabilities that CISA has confirmed are being actively exploited in the wild. It was established by CISA Binding Operational Directive 22-01 in November 2021, which mandates that US federal civilian executive branch agencies patch listed vulnerabilities within specified deadlines, typically 2 weeks for vulnerabilities added after November 2021. Private sector organisations are not legally required to comply, but CISA strongly recommends treating KEV entries as high-priority vulnerabilities and publishes the catalog as a public resource to benefit any organisation seeking to prioritise remediation based on confirmed exploitation evidence.
EPSS (Exploit Prediction Scoring System) uses a machine learning model trained on historical exploitation data to estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The model is updated daily and incorporates features including the CVSSv3 score, vulnerability type, affected software category, vendor, and signals from threat intelligence sources about exploitation activity and exploit availability. Scores range from 0 to 1 (displayed as 0% to 100%), with higher scores indicating higher exploitation probability. The model is publicly documented and its performance metrics are published by FIRST, allowing organisations to understand its accuracy characteristics.
A zero-day vulnerability is one for which no vendor-supplied patch exists at the time it is being exploited; the vendor has had zero days to address it. An N-day vulnerability is one for which a patch has been available for N days, meaning the window of "vendor-acknowledged exploitation" has passed and the question is purely about patching speed. The distinction matters for risk assessment: zero-days cannot be fully remediated through patching (only through compensating controls) until a patch is released, while N-day vulnerabilities can be fully remediated if the patch is applied. In practice, many organisations are most exposed to N-day vulnerabilities because their patching cadence leaves significant windows during which known, patchable vulnerabilities remain unaddressed in production systems.
End-of-life software that is no longer receiving security patches represents a permanent exposure to unpatched vulnerabilities that vendors will not fix. For vulnerabilities in EOL software that appear in the KEV catalog or have high EPSS scores, the appropriate response is not to wait for a patch that will never come, but to implement compensating controls (network isolation, access restriction, WAF rules) and to accelerate migration away from the EOL software. The operational cost of running EOL software in a network-accessible position typically exceeds the migration cost when the full risk exposure is accounted for, but short-term operational inertia often delays migrations until a confirmed exploitation event provides the urgency needed to override organisational resistance to change.
A risk-based patching programme replaces the calendar-driven model (all critical vulnerabilities patched within 30 days, high within 90 days) with a model where patch priority is determined by actual risk to the organisation, combining vulnerability severity, exploitation likelihood, asset criticality, and network exposure. The calendar model's failure mode is that it applies the same urgency to a critical vulnerability in software not present in the environment and to a critical KEV entry in a publicly exposed service, which are categorically different risk levels requiring categorically different response timelines.
Implementing a risk-based model requires enriching vulnerability data with four layers of context. First, asset inventory: which systems are affected, and what is their business criticality and network exposure? Second, exploitation data: is this vulnerability in the KEV catalogue? What is its EPSS score? Is a working exploit publicly available? Third, compensating controls: are there WAF rules, network segmentation, or other controls that reduce the exploitability in this specific environment? Fourth, patching cost: how disruptive is the patch, what testing is required, and what is the change management overhead? These factors combined produce a risk score that is specific to the organisation's environment rather than generic to the vulnerability.
The output of this enriched risk assessment is a dynamic prioritisation list that changes as new intelligence becomes available. A vulnerability that scored medium priority last week becomes critical this week when it is added to the KEV catalogue or when a new working exploit is published. The intelligence feeds that update this prioritisation in near-real-time are what make risk-based patching a continuous process rather than a periodic exercise. Integrating KEV and EPSS data with the external attack surface visibility that Defendis provides creates the complete picture needed to maintain an accurate risk-based patching priority list without manual data aggregation.
Translating vulnerability intelligence into terms that drive resource allocation decisions by non-technical stakeholders is an analytical challenge that many security teams underinvest in. A patch backlog that the CISO cannot explain to the board in business risk terms is less likely to receive the resources needed to address it than one connected to concrete scenarios: "This unpatched vulnerability in our customer portal is currently being actively exploited against financial services organisations in the UK; exploitation could expose customer financial data and trigger regulatory notification requirements."
The KEV catalogue and EPSS scores provide exactly the data needed to make these concrete risk statements: confirmation that a vulnerability is being exploited now (KEV) and a quantified probability of exploitation within 30 days (EPSS). Translating these technical indicators into business risk language, connecting the vulnerability to the data it could expose and the regulatory and reputational consequences, produces the stakeholder communication that justifies emergency patching investments. Defendis helps connect vulnerability intelligence to your specific exposure profile for precisely this kind of stakeholder communication.
APT campaign infrastructure leaves detectable traces: newly registered domains matching known attacker patterns, TLS certificates with characteristic fields, and C2 servers reusing known bulletproof hosting. Defendis monitors these signals alongside CISA KEV updates and exploit availability data to surface intelligence that connects external threats to your specific technology stack and exposure profile. When a KEV entry affects software you run, or when APT infrastructure targets your sector, Defendis delivers a prioritised alert before the threat reaches your environment.
Request a demo to see how Defendis maps APT intelligence and vulnerability exposure to your organisation's specific risk profile.
