6 entries
What CISA's Known Exploited Vulnerabilities catalogue is, the three tests for inclusion, how BOD 26-04 sets federal deadlines by exposure and impact, and how Australian teams should use it.
CVE names a flaw. CVSS scores a severity model. EPSS estimates exploit likelihood. KEV records known exploitation. Your triage joins all four to exposure and asset value.
A vendor fix for a hole or a defect. Installing it is patching. Explaining why you did not is an exception with an expiry date.
A weakness in requirements, design, build, or operations that can be tripped or abused and break the security policy.
Find, rank, fix, check. Known-exploited and exposure beat a 400-page scanner PDF.
A usable flaw the vendor has not disclosed or patched yet. Your window is not a blog post. It is exposure.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary