KEV is a filter, not a to-do list
CISA's Known Exploited Vulnerabilities catalogue is the best triage input most teams have, and the most commonly misused. A note on what it does and does not tell you.
Writing
2 posts. Newest first.
Compliance automation is mostly an evidence problem
The hard part of automating a control assessment is not evaluating the control. It is producing something an assessor will accept as proof.