KEV used to be a patch list. Now, for most of what CISA adds, it is an IR list: was this box already owned?
48 of the 73 KEV entries added since July 1 carry CISA's forensic-triage flag. The 1,630 before them predate it.
BOD 26-04's top tier: 3 days & forensic triage.
