The truth about KEV: CISA’s vuln deadlines good influence on private-sector patching The deadlines associated with CISA's Known Exploited Vulnerabilities (KEV) catalog only apply to federal agencies, but fresh research shows they're having a positive impact on private organizations too.