You will have seen the phrase in the security headlines this week: “CISA added the flaw to its Known Exploited Vulnerabilities catalog.” Two new entries landed on that list on Friday — including a Cisco phone-system bug now under active attack, as reported by BleepingComputer. So what actually is the KEV catalog, and why should a business owner care?

In plain English: the KEV catalog is a public list, kept by the US Cybersecurity and Infrastructure Security Agency (CISA), of software vulnerabilities that are confirmed to be exploited in real-world attacks. Not theoretical weaknesses someone might use one day — flaws being used against real organisations right now.

Think of it as a “most wanted” list for security holes. Tens of thousands of vulnerabilities are disclosed every year, and no business can patch all of them the moment they appear. The KEV catalog cuts through that noise: these are the ones already causing damage, so they jump the queue.

Here is the part most people miss. It is a US government list, but it has quietly become the world’s best free patch-prioritisation feed. Australian IT providers — ours included — check it against client systems every week. When something lands on KEV, it changes our patching priorities that same day, regardless of what the original severity score said.

You do not need to read the catalog yourself. You just need to know that someone does. Ask your IT provider one question: “When CISA flags a vulnerability that affects our software, how quickly do we patch it?” If the answer is vague, that is a gap worth closing. A good managed IT service treats KEV as a standing to-do list, not a newsletter.