CISA KEV burst
Counts vulnerabilities CISA added during the latest seven days, compares that count with 26 prior non-overlapping weeks using a median/MAD robust z-score, then adds disclosed ransomware and urgent-deadline terms.
Intelligence Status: CISA exploitation evidence, EPSS forward probabilities, and cross-source precursor language.
30-day exploitation pressure
Cyber Exploitation Early Warning
Loading the latest accepted warning snapshot…
—/100
—
CISA KEV Addition Radar
Confirmed in-the-wild exploitation · latest seven days
Warning History
Accepted early-warning snapshots · up to 180 observations
Reproducible method · version 2.0
Methodology
This index measures global exploitation pressure for analyst triage. It is not an organisation-specific breach probability and does not claim that a product is present in any network.
EPSS frontier momentum
Examines the highest EPSS probabilities above 0.10 that are not yet in KEV. Current probability and seven-day acceleration identify vulnerabilities moving toward observed exploitation during EPSS’s next-30-day horizon.
Cross-source precursor language
Measures named-source confirmation of weaponization, mass scanning, perimeter access, and campaign-shift phrases. Repeated items from the same named source count once for cross-source confirmation.
Index = availability-renormalized weighted mean + 5 points only when at least two components reach WATCH. Missing components never silently score zero. Verified source snapshots may be retained for at most 72 hours and are visibly marked.