CISA KEV Analyzer

A Python data analysis script that pulls the full CISA Known Exploited Vulnerabilities (KEV) catalog and runs several filters and summaries useful for GRC and security operations work.

No API key required. CISA publishes this as a free, public JSON feed.

---

Features

• Fetches the live KEV catalog directly from CISA (1,590+ entries as of May 2026)
• Loads the full dataset into pandas for flexible filtering and analysis
• Surfaces newly added KEVs from the last 90 days for patching prioritization
• Ranks vendors by total KEV count — useful for third-party risk assessments
• Shows year-over-year KEV addition trends for executive/board reporting
• Keyword search across vendor, product, vulnerability name, description, and required action fields
• Ransomware CVE cross-reference against a curated threat intel list
• Exports results to a multi-tab Excel workbook for stakeholder sharing or audit evidence

---

Requirements

pip install requests pandas tabulate openpyxl

Python 3.8+ recommended. No .env file or API key needed.

---

Usage

python CISA-KEV.py

The script runs end-to-end automatically and prints results to the terminal, then exports kev_analysis.xlsx to the working directory.

---

Output

Terminal

Section	Description
Column overview	Schema and dtypes for the full DataFrame
Newly added (last 90 days)	Most recent KEVs sorted by date added
Top 15 vendors by KEV count	Vendor risk ranking
KEVs added per year	Year-over-year trend
Microsoft KEVs	Filtered view for the top KEV vendor
Ransomware-related KEVs	CVEs tied to known ransomware campaigns

Excel — kev_analysis.xlsx

Sheet	Contents
Full Catalog	All KEV entries with derived columns
Recent (90d)	KEVs added in the last 90 days
Top Vendors	Vendor ranking by KEV count
Microsoft	All Microsoft KEVs

---

Customization

Change the recency window

cutoff = datetime.now() - timedelta(days=90)  # adjust days as needed

Search for a specific vendor or product

results = search_kevs("Ivanti")
results = search_kevs("Cisco")

Broad search (includes description and required action fields)

results = search_kevs_broad("SQL injection")
results = search_kevs_broad("ransomware")

Filter by ransomware-associated CVEs

Update the RANSOMWARE_CVES set with CVEs from your threat intelligence sources:

RANSOMWARE_CVES = {
    "CVE-2021-44228",  # Log4Shell
    "CVE-2023-34362",  # MOVEit — Cl0p
    # add more from CISA advisories, ISACs, vendor reports
}

Enable the overdue entries report

Uncomment Section 6 to surface KEVs whose CISA-mandated patch deadline has passed. Most relevant for federal agencies subject to BOD 22-01, but also useful as a severity proxy in any environment.

---

Skills Demonstrated

• Python data analysis — pandas DataFrame construction, filtering, grouping, derived columns, date arithmetic
• REST API consumption — requests against a public JSON feed with error handling
• GRC-relevant analysis — KEV triage, vendor risk ranking, ransomware CVE correlation, patch deadline tracking
• Threat intelligence integration — knownRansomwareCampaignUse field filtering, curated CVE cross-referencing
• Reporting and evidence packaging — multi-tab Excel export via openpyxl suitable for audit artifacts or stakeholder briefings

---

Potential Extensions

• Cross-reference against an internal asset inventory (CSV/CMDB export) to produce a prioritized remediation list
• Enrich with CVSS scores from the NVD API for risk-ranked output
• Schedule as a weekly job and diff against a prior run to alert on net-new KEVs only
• Feed results into a SIEM or GRC platform via API rather than Excel export

---

Author

Aaron Dutton
License: MIT