# KEVIntel

> KEVIntel is a Known Exploited Vulnerabilities (KEV) intelligence service that combines CISA KEV, public exploitation evidence, vendor advisories, enrichment (EPSS, CVSS, CWE, PoCs), proprietary honeypot/sensor telemetry, confidence scoring, and virtual patch guidance to help security teams prioritize, detect, report, mitigate, and respond to the vulnerabilities attackers are actively exploiting.

KEVIntel is operational Known Exploited Vulnerabilities intelligence, not just a CISA KEV mirror. Out of hundreds of thousands of CVEs, only a small fraction are ever exploited in the wild, so KEVIntel focuses on exploitation-led prioritization: which known exploited vulnerabilities are attackers actually exploiting, what evidence supports that, how confident we are, and what teams should do next.

CISA KEV is the authoritative baseline. KEVIntel goes beyond it with additional known exploited vulnerabilities not yet in the CISA KEV catalog, evidence-backed attestation, RSS delivery (which CISA KEV does not offer), proprietary sensor telemetry, confidence scoring, enrichment that saves analyst time, and practical artifacts for vulnerability management, CTI, SOC/detection, MSSP/MDR, exposure-management, and virtual patching workflows. Intelligence is delivered through the UI, a free registered RSS feed, a free registered JSON feed, and the Pro and Enterprise APIs.

KEVIntel was founded by Ryan Dewhurst, a cybersecurity professional focused on real-world exploitation, threat intelligence, and honeypot/deception operations, and the creator of Damn Vulnerable Web Application (DVWA) and WPScan (acquired in 2021).

## Core pages

- [Home](https://kevintel.com/): Overview of KEVIntel's evidence-backed exploitation intelligence, telemetry, and confidence scoring.
- [KEV Feed](https://kevintel.com/feed): Browse known exploited vulnerabilities with CISA KEV status, confidence, sensor observations, and available artifacts.
- [Exploitation Signals](https://kevintel.com/exploitation-signals): Observed exploitation attempts against internet-facing services, mapped to CVEs.
- [Attacker Intelligence](https://kevintel.com/attacker-intelligence): Cross-CVE source IP intelligence from KEVIntel sensor telemetry.
- [Methodology](https://kevintel.com/methodology): How KEVIntel collects, attests, scores, enriches, and delivers exploited-vulnerability intelligence, including evidence sources and confidence levels.
- [Use Cases](https://kevintel.com/use-cases): How vulnerability management, CTI, SOC, MSSP, virtual patching, and exposure-management teams use KEVIntel.
- [Virtual Patches](https://kevintel.com/virtual-patches): Virtual patch guidance to create temporary WAF/IPS controls while remediation is underway.
- [Stats](https://kevintel.com/stats): Live KEVIntel statistics, including exploited-CVE coverage and sensor telemetry.

## Compare and pricing

- [KEVIntel vs CISA KEV](https://kevintel.com/cisa-kev-comparison): How KEVIntel complements and goes beyond the official CISA KEV catalog.
- [CISA KEV RSS feed](https://kevintel.com/cisa-kev-rss-feed): KEVIntel provides RSS delivery for KEV data, which CISA KEV does not.
- [Pricing](https://kevintel.com/pricing): Free, Pro, and Enterprise tiers for exploited-vulnerability intelligence.
- [API and integrations](https://kevintel.com/api-integrations): Delivery channels and how to plug exploitation intelligence into existing workflows.
- [API documentation](https://kevintel.com/api-docs): OpenAPI reference for the v2 KEV, Pro, and Enterprise APIs.

## Data and feeds

- [Free KEV RSS Feed](https://kevintel.com/account/signup): Registered free RSS with a personal subscribe URL from your account dashboard (`GET /feeds/kevs.rss?token=…`).
- [Sign up for the free KEV JSON feed](https://kevintel.com/account/signup): Create a free account to get an API token for the JSON feed; Pro and Enterprise APIs add enriched records, confidence scoring, telemetry, and virtual patches.

## About

- [About KEVIntel](https://kevintel.com/about): What KEVIntel is, the problem it solves, and the team behind it.
- [Ryan Dewhurst (founder)](https://ryandewhurst.com/): Founder of KEVIntel; creator of DVWA and WPScan (acquired 2021).
- [Contact](https://kevintel.com/contact): Get in touch about Pro, Enterprise, MSSP, or API access.

## Optional

- [Privacy policy](https://kevintel.com/privacy)
- [Terms of service](https://kevintel.com/terms)