CISA KEV Catalog: How Small IT Teams Can Use It
The catalog is a federal deadline list, but it is also the shortest free answer to 'what do we patch first'. A dated breakdown of the public feed shows how.
Independent security research
Security claims, checked against the evidence.
Plain-English guides and comparisons for small and mid-size teams. Every figure is read at its source and dated, and every article says how it was checked.
- 12
- reports published
- 201
- sources cited
- 0
- field tests claimed
Exploited-vulnerability cataloglatest additions, as of
- CVE-2026-20320 Cisco BroadWorks added
- CVE-2026-125350 Google Chromium added
- CVE-2026-124194 Microsoft Office added
- CVE-2026-116606 Barracuda Networks Email Security Gateway added
- CVE-2026-111793 Openwave Messaging Webtop Media Transcoder added
- CVE-2026-111560 Barracuda Networks Multiple Products added
- CVE-2026-123218 IBM Aspera Faspex added
- CVE-2026-123158 OpenBSD OpenSSH added
- CVE-2026-116779 SignalWire FreeSwitch added
- CVE-2026-102895 GPUStack GPUStack added
01 / Reports
All reportsLatest reports
Incident Response Plan for Small Business: A Working Guide
A plan for a small team is mostly names, numbers and decisions made in advance. Here is what NIST, the NCSC and CISA say it needs, and what your cloud logs actually keep.
Security Frameworks for Small Business: Which to Choose
NIST, CIS, Cyber Essentials, ISO 27001 and SOC 2 are different kinds of thing. Here is what each one is, who asks for it, and where a team of 10 to 250 should start.
Small Business Backup Strategy: Copies, Locks and Restores
What to back up, where the copies should live, how long to keep them and how to prove they restore, set out from CISA, NCSC and vendor documentation.
Endpoint Security for Small Business: Devices, Patching and EDR
Supported systems, fast patching, encryption, no everyday admin rights and anti-malware that is switched on. What each control needs, what it costs and what to do first.
Business Email Security: A Guide for Small Organisations
Most phishing and payment fraud now arrives through mail platforms that already filter it. Here is what the built-in protection covers, what costs extra, and what no filter can do for you.
Multi-Factor Authentication for Small Business: Methods, Settings and Rollout
Which sign-in methods stop phishing, which only slow it down, and what your Microsoft or Google licence actually lets you enforce. A rollout order for 10 to 250 people.
02 / Evidence
Full methodTwo labels, and what each one means
Every article carries one of these. The label tells you what kind of checking stands behind it.
Desk research
Read at the source, nothing installed
Prices, limits and rules are read from the vendor's or regulator's own page and dated. No product was run. All 12 current articles carry this label.
Field-tested
Run by us, with the logs published
Used only when a test was carried out and its logs, screenshots or measurements are published with the article. The site's build refuses this label without them.
03 / Topics
All topicsWhat we cover
Identity and access
Passwords, password managers, single sign-on, multi-factor sign-in and passkeys.
1 report, 1 guideEmail and phishing
Mail authentication, filtering for Microsoft 365 and Google Workspace, and phishing defence.
1 report, 1 guideDevices and endpoints
Device management, endpoint detection, patching and antivirus for mixed fleets.
1 report, 1 guideBackup and recovery
Backing up cloud services and devices, testing restores and recovering from ransomware.
1 report, 1 guideCompliance and audits
Security frameworks, certifications, audit tooling and legal reporting duties.
1 report, 1 guideSecurity operations
Vulnerability prioritisation, monitoring, incident handling and tooling for IT providers.
1 report, 1 guide04 / Method
Editorial policyHow an article is made
Start from a gap
A topic is written only when it can add something the current results lack, such as a dated price table or the clause itself.
Read the source
Figures come from the provider's or regulator's own page. What could not be read is left out and listed.
Pass the gate
Automated checks block an article with missing sources, undated prices or a claim of testing that did not happen.
Date and correct
Each source shows when it was checked. Changes are noted on the page, and corrections are logged in public.