Method

What the numbers mean, where they come from, and what they leave out. Everything here is reproducible from the open code and the published files.

Sources

• CISA Known Exploited Vulnerabilities (KEV). CVEs that CISA has confirmed as exploited in the wild, with the date each was added, the vendor and product named, and whether ransomware use is known. Public domain (CC0).
• NIST National Vulnerability Database (NVD). The CVE record for each KEV entry: publication date, CVSS severity, weakness types, and description. Only CVEs in KEV are collected for now.

Both are fetched daily. Every row in the downloads names its source, crawl time, and license.

Who counts as a security vendor

A vendor counts if security is its primary business: what it is mainly known for and earns most of its revenue from. A generalist with a security product line does not count, however large: Cisco, Microsoft, and Juniper are not security vendors here, while Fortinet, Palo Alto Networks, and Sophos are.

The rule applies to the company KEV names. An acquired security company keeps its own row (Pulse Secure counts, although Ivanti owns it now). Borderline calls, such as Ivanti, F5, and Splunk, are listed with the reason in the curated vendor list, each security vendor cites a source, and changes go through public review.

Matching vendor names

KEV names vendors in free text. Names are matched exactly to the curated list, after Unicode and whitespace normalization and ignoring case, and through a reviewed alias table (for example, Android counts as Google). Names that match nothing are published on the data page rather than guessed; their entries count toward totals but not toward any vendor.

Measures

Known ransomware use

CISA's own flag on each KEV entry. "Unknown" means not known, not "no"; the share is a lower bound.

Time to KEV

Days from the CVE's NVD publication date to the day CISA added it to KEV. Zero means it was listed the day it was published, often because it was already being exploited as a zero-day. Only CVEs published since KEV launched (November 3, 2021) are included: the launch added a backlog of long-known flaws, which would otherwise dominate the comparison.

Security-vendor share per month

KEV entries added each month, counting an entry once even when it names several products.

Limits

• KEV covers vulnerabilities CISA has confirmed as exploited, mostly in products used by US agencies. It is not a census of all exploitation.
• A vendor with more KEV entries is not necessarily less secure: popular products attract more attackers, and vendors differ in how they disclose.
• Medians are over small groups (tens of security-vendor CVEs), so single entries can move them.

Corrections

This dataset names real organizations, so every record is sourced and correctable. See the corrections process and the data policy. Leaked data is never collected. If a public correction request would itself cause harm, email contact5@kuricove.com.