CISA KEV Catalog: How Small IT Teams Can Use It
The catalog is a federal deadline list, but it is also the shortest free answer to 'what do we patch first'. A dated breakdown of the public feed shows how.
Independent security research
Security claims, checked against the evidence.
Plain-English guides and comparisons for small and mid-size teams. Every figure is read at its source and dated, and every article says how it was checked.
- 6
- reports published
- 81
- sources cited
- 0
- field tests claimed
- 0
- paid placements
Exploited-vulnerability cataloglatest additions, as of
- CVE-2026-20320 Cisco BroadWorks added
- CVE-2026-125350 Google Chromium added
- CVE-2026-124194 Microsoft Office added
- CVE-2026-116606 Barracuda Networks Email Security Gateway added
- CVE-2026-111793 Openwave Messaging Webtop Media Transcoder added
- CVE-2026-111560 Barracuda Networks Multiple Products added
- CVE-2026-123218 IBM Aspera Faspex added
- CVE-2026-123158 OpenBSD OpenSSH added
- CVE-2026-116779 SignalWire FreeSwitch added
- CVE-2026-102895 GPUStack GPUStack added
01 / Reports
All reportsLatest reports
Data Breach Notification Deadlines by Jurisdiction
Seventy-two hours is the number everyone remembers. The laws differ on what starts the clock, who must be told, and whether an IT provider reports at all.
Microsoft 365 Backup Pricing: Per User or Per Gigabyte
Microsoft bills its own backup by the gigabyte; most rivals bill by the user. Which is cheaper depends on one number: how much data each person holds.
MDM for Small Business: Costs by Minimum Order Size
The per-device price is rarely what a 10-device company pays. Minimum orders, annual-only billing and free tiers decide the real bill.
SPF, DKIM and DMARC: What Mailbox Providers Require
Gmail, Yahoo and Outlook.com now reject mail that fails authentication. The thresholds differ, and one tag in most vendor examples is no longer in the standard.
NIST Password Guidelines: The Rules Now Prohibited
The current NIST standard forbids several habits most password policies still enforce. Here is each clause, and what Microsoft and Google let you change.
02 / Evidence
Full methodTwo labels, and what each one means
Every article carries one of these. The label tells you what kind of checking stands behind it.
Desk research
Read at the source, nothing installed
Prices, limits and rules are read from the vendor's or regulator's own page and dated. No product was run. All 6 current articles carry this label.
Field-tested
Run by us, with the logs published
Used only when a test was carried out and its logs, screenshots or measurements are published with the article. The site's build refuses this label without them.
03 / Topics
What we cover
Identity and access
Passwords, password managers, single sign-on, multi-factor sign-in and passkeys.
1 reportEmail and phishing
Mail authentication, filtering for Microsoft 365 and Google Workspace, and phishing defence.
1 reportDevices and endpoints
Device management, endpoint detection, patching and antivirus for mixed fleets.
1 reportBackup and recovery
Backing up cloud services and devices, testing restores and recovering from ransomware.
1 reportCompliance and audits
Security frameworks, certifications, audit tooling and legal reporting duties.
1 reportSecurity operations
Vulnerability prioritisation, monitoring, incident handling and tooling for IT providers.
1 report04 / Method
Editorial policyHow an article is made
Start from a gap
A topic is written only when it can add something the current results lack, such as a dated price table or the clause itself.
Read the source
Figures come from the provider's or regulator's own page. What could not be read is left out and listed.
Pass the gate
Automated checks block an article with missing sources, undated prices or a claim of testing that did not happen.
Date and correct
Each source shows when it was checked. Changes are noted on the page, and corrections are logged in public.
Payment never buys a verdict or a rank
Companies can pay to be evaluated or to place a labelled advertisement. They cannot pay for inclusion, position or wording. Paid items are labelled where they appear.