The Sentinelt Cyber Intelligence Brief #001 reads 90 days of official public data (June 22 – September 20, 2026) from NIST NVD, CISA KEV and FIRST EPSS through the Sentinelt Cyber Priority Framework. Five findings stand out.
1. The signal is 0.3% of the noise
35,764 vulnerabilities were published in 90 days — about 400 per day. In the same window, CISA catalogued 93 as known to be exploited. No small team can read the first number; the job is to find the second.
2. Severity alone would have missed exploited vulnerabilities
Of the 93 newly catalogued exploited vulnerabilities, 31 were rated High and 8 Medium; only 54 were Critical. Across the whole year the pattern holds: 11% of all 1,716 KEV entries are Medium or Low. Triage that starts at “Critical only” starts in the wrong place.
3. There is no comfort window
17 of the 93 (18%) were catalogued as exploited on or before the day NVD published them, and 42 (45%) within seven days. Median: 12 days. Quarterly patch reviews are structurally late for this group.
Caveat: this measures the CISA catalog date, not the date of first exploitation.
4. Edge and management infrastructure is where exploitation concentrates
Over 12 months, the exploitation rate per published vulnerability was roughly ten times higher for Cisco, Ivanti, Fortinet, SolarWinds and JFrog (6–11%) than for Microsoft (1%). Firewalls, VPNs, remote-management and DevOps tools deserve a shorter patch clock than desktop software.
5. Old does not mean safe
9 of the 93 were more than a year old when catalogued — including a Cisco IOS vulnerability from 2008. Inventory hygiene on legacy systems remains a live exposure, not a historical one.
What this means for your team
- Prioritize by evidence of exploitation, not by severity alone.
- Give internet-facing and management infrastructure a shorter patch clock.
- Keep an inventory that includes legacy systems.
Disclaimer
Sentinelt Priority reflects publicly available evidence (NIST NVD, CISA KEV, FIRST EPSS) and does not assess any specific organization’s exposure. It is not a substitute for vulnerability scanning or professional security assessment. This product uses the NVD API but is not endorsed or certified by the NVD. KEV listing means exploitation has been observed somewhere, not that any particular organization is compromised. EPSS is a population-level 30-day estimate.