Jerry Gamblin

Bringing clarity to vulnerability intelligence through open-source tools. Founder of RogoLabs | Creator of http://cve.icu & http://patchthis.app.

Website: https://jerrygamblin.com
RogoLabs: https://rogolabs.net

Last Notes

2026-09-10 13:34:02 UTC

KEV used to be a patch list. Now, for most of what CISA adds, it is an IR list: was this box already owned?
48 of the 73 entries CISA has added to the KEV list since July 1 carry its forensic-triage flag. The 1,630 entries added before that date do not.
When I wrote about BOD 26-04 in June, the three-day clock was the argument. The catalog says the clock was the smaller half. The directive, issued June 10, replaced the flat KEV deadline with a risk table, and its top tier is three days plus what CISA calls "& forensic triage". The directive defines that: "carry out a forensic triage of the asset to assess whether the system is compromised." CISA cited the requirement in June entries, the per-entry flag starts July 1, and CISA publishes which entries carry it.
Your process is at least built for the patch half. The other half is a person opening up the box, preserving evidence, and deciding whether to call it an incident. Two thirds of new KEV entries now need somebody who can make that call inside three days.
BOD 26-04 binds federal agencies. You're outside it, and the flag is CISA's worst-case exposure call, which agencies settle asset by asset. It fires on internet-reachable, automatable, total-impact exploitation, and that's the profile where patching on day three still leaves day one unaccounted for.
If a flagged KEV entry landed on you this afternoon, who makes the was-it-already-compromised call: the patch owner, or IR?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/246/999/024/921/195/original/4fd6c0f08b23342d.png

2026-09-02 22:07:39 UTC

- reply

Maybe not exactly what you asked for but I recently did this: https://www.linkedin.com/feed/update/urn:li:activity:7496228791048949761/

2026-04-19 00:00:47 UTC

Version 2 of my CVE Intelligence TA for
Splunk is live on Splunkbase.
I’ve added EPSS probability, CISA KEV status, and SSVC data to the baseline for 327k+ vulnerabilities.
No API keys, zero-config, and pre-joined lookups for faster triage.
Full details and download: https://jerrygamblin.com/2026/04/18/prioritizing-what-matters-bringing-cve-intelligence-to-splunk/

2025-08-08 18:01:41 UTC

At @npub1dqd…8xy4? I'm speaking today at 1PM in the @npub1p9t…68rj. Stop by to hear me talk about the post NVD era of vulnerability data.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/994/452/716/706/009/original/47c4974d50fc8bba.jpeg