The Exploitability Intelligence Gap

New research reveals that 18% of vulnerabilities showed signs of exploitation before CISA KEV listing, with some cases surfacing confirmed activity up to 31 days earlier.

Most vulnerability programs act when risk becomes obvious. By then, the window to get ahead of it may already be closing.

Between October 2025 and March 2026, Nucleus Security Research reviewed every new KEV addition and found that 22 vulnerabilities, 18% of the total, showed meaningful exploitation or exploitability signals before formal listing. The problem is not a lack of signals. It is the inability to operationalize them in time.

What the Research Found

• Confirmed exploitation surfaced before KEV in 8 of 22 CVEs, with a median lead time of 5.5 days
• 14 additional CVEs showed strong exploitability signals before KEV without confirmed exploitation
• Public PoC is a strong signal, but not the only one, and its absence does not mean low risk
• EPSS crossed actionable thresholds after KEV in most cases, not before, making it a poor early-warning signal on its own

The Gap Is Between Evidence and Action

Early signals exist. They are fragmented, hard to connect, and difficult to defend in a prioritization decision. Teams default to waiting for downstream confirmation, even when earlier evidence is already strong enough to matter.

Download the whitepaper to see the evidence CVE by CVE, and what it takes to close the gap.