14 Oct 2026 · Nadia Ferreira-Strand (editorial persona) · MSP and SMB channel · on threat.cafe

Unpatched edge devices sit behind 29% of opportunistic attacks: a KEV-only alert rule an MSP can staff

Send a client alert only when two conditions are true: the vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, and it affects an internet-facing device or remote-access tool that client actually runs. Everything else goes into the normal patch cycle. The rule is narrow on purpose. In the 2026 KEV catalog, 61 of 262 additions through 15 October hit edge appliances or remote-support tools. That is about 1.5 entries a week to match against your inventory. A two-person MSP security desk can work that queue. It cannot work 66,000 CVEs.

Outcome, time and access

Outcome. One written alert rule, one weekly matching job, and one ticket template per client.

Time. Half a day to write the rule. One to two days to clean the edge inventory. About an hour a week to run the match.

Access you need.

Read access to your RMM or PSA asset records for every tenant.
A list of each client's public IP ranges and the devices behind them.
Change authority, or a named client contact who has it, for firewalls, VPN gateways and remote-access tools.

Why the rule is edge-first

Start with the attack data. The Cyber Readiness Institute's summary of the 2026 Verizon DBIR says many small-business attacks are opportunistic. The victims "had credentials that were compromised (38%) or unpatched vulnerabilities in edge devices (29%)." The same summary says small organisations make up 96% of ransomware victims. Verizon's own DBIR 2026 release puts vulnerability exploitation as the first step in 31% of all breaches.

Then look at volume. Trend Micro's July 2026 analysis counts 48,185 CVEs in 2025 and cites a FIRST projection of about 66,000 for 2026. The share actively exploited was "well under 1%" in both 2024 and 2025. Alerting on CVSS scores sends you thousands of tickets about bugs nobody is using.

KEV is the exploited slice. The edge filter is the slice that an attacker can reach from the internet without a password.

What the 2026 KEV catalog actually contains

The threat.cafe editors pulled CISA's catalog from the official cisagov/kev-data repository (catalog version 2026.10.15, 1,746 entries) and counted additions by date.

KEV additions                 2024   2025   2026 (to 15 Oct)
All entries                    186    245    262
Edge + remote-access subset      -      -     61
Per week, all entries          3.6    4.7    6.4
Per week, edge subset            -      -    1.5

The 2024 and 2025 totals match the KEV counts in the Trend Micro analysis. The edge subset is our classification. It counts firewalls, VPN and remote-access gateways, SD-WAN, routers, switches and load balancers (Fortinet FortiOS and FortiMail, Ivanti Connect Secure and Sentry, Citrix NetScaler, Palo Alto Networks PAN-OS, Cisco ASA, FTD, IOS and SD-WAN, SonicWall SMA1000, F5 BIG-IP, Check Point gateways, MikroTik RouterOS, Ubiquiti UniFi OS, Zyxel, D-Link and similar). It also counts remote-support tools an MSP itself runs: ConnectWise ScreenConnect, SimpleHelp, N-able N-central and BeyondTrust Remote Support. Nine 2026 entries fall in that second group. Four of those nine are marked as known to be used in ransomware campaigns.

Two more numbers set your service levels. For these 61 entries, the median gap between the CVE record's publication and its KEV listing was 5 days, measured against the CVE List V5 records. Twenty-two were listed on or before the day the CVE was published. CISA's federal due dates for the same entries ran from 2 to 21 days after listing, with a median of 3 days.

The volume is not flat. September 2026 alone added 18 edge and remote-access entries. Staff for the bad month.

Use this rule if / do not use it if

Use it if you manage perimeter devices for many small clients, you have no dedicated vulnerability analyst, and clients ignore your current CVE emails.

Do not use it as your only control if a client runs internet-facing applications you host or build. Add their web stack to the edge list. Do not use it if a regulator requires a broader patch policy. Run this rule alongside that policy, not instead of it.

Step-by-step: build and run the rule

Write the rule. Paste this into your service description: "We alert you within one business day when a vulnerability in CISA's KEV catalog affects an internet-facing device or remote-access tool in your environment. All other vulnerabilities are patched on the monthly cycle."
Build the edge inventory. For each tenant, export firewalls, VPN gateways, remote-access tools, routers, NAS devices with public services, and public-facing servers. Record vendor, product and firmware version. Verify: every public IP in the client's range maps to one inventory row. Stop here if any IP is unexplained. An unknown internet-facing device is your first finding.
Normalise names. KEV uses vendorProject and product fields, such as Fortinet / FortiOS. Map your RMM's product strings to those values once and store the mapping.
Pull KEV daily. Fetch the JSON feed from the cisagov/kev-data repository. Keep the previous copy. New entries are rows whose dateAdded is newer than your last run.
Match. Join new entries to the edge inventory on vendor and product. Then check the affected versions in the vendor advisory. KEV names the product, not the vulnerable version range. Verify: each match has a vendor advisory link before it becomes a ticket.
Open one ticket per client per entry. Include the CVE ID, the device, the vendor fix or mitigation, CISA's requiredAction text, and the knownRansomwareCampaignUse value.
Set the clock. Mitigate within 72 hours of the alert. Patch or replace within the vendor's guidance or 14 days, whichever is sooner. These are policy choices, not CISA requirements for private companies. CISA's due dates bind US federal civilian agencies.
Close with evidence. Record the firmware version after the change, or a screenshot of the disabled feature. Verify the device no longer reports the vulnerable version.

Staffing calculator

Use your own numbers. The formula is:

weekly tickets = KEV edge entries per week x average clients running each affected product
weekly hours   = weekly tickets x hours per ticket
FTE            = weekly hours / 37.5

Illustrative example: an MSP with 100 clients sees 1.5 edge entries a week. Suppose each entry matches 4 clients on average, and each ticket takes 2 hours including client contact. That is 6 tickets and 12 hours a week, about a third of one person. In a September-sized month, plan for roughly three times that.

The multiplier that matters is vendor concentration. If 60 of your 100 clients run the same firewall brand, one FortiOS entry becomes 60 tickets in a day. Check your concentration before you promise one business day.

Three failure modes and their fixes

Failure 1: the inventory is wrong. The match finds nothing because the client's VPN appliance was never in the RMM. Fix: run an external attack-surface scan of each client's public ranges quarterly and reconcile it against inventory. Treat any unreconciled service as an open ticket.

Failure 2: KEV is late for you. KEV lists what CISA has evidence is exploited. A vendor may publish an emergency advisory days before the listing. The 5-day median gap above is a median, not a ceiling. Fix: subscribe to the security advisory feeds of the top five edge vendors in your client base. Treat a vendor advisory that says "exploited in the wild" the same as a KEV listing. Use FIRST's EPSS daily scores as a second signal for non-KEV edge CVEs, not as a trigger for client alerts.

Failure 3: your own tools are the edge. Nine 2026 KEV entries hit remote-support and RMM products of the kind MSPs run to reach clients. A flaw in one of those is a flaw in every tenant at once. Fix: put your own management stack at the top of the edge inventory. Patch it before any client device. Tell clients when you do.

Rollback and health check

If the rule floods the desk, do not drop back to CVSS alerts. Narrow the edge list to devices with management interfaces exposed to the internet, and fix those exposures first. Run a monthly health check:

Percentage of KEV edge matches mitigated inside 72 hours.
Number of public services found by scan but missing from inventory.
Number of vendor "exploited" advisories that arrived before the KEV listing.

The rule covers known exploitation only. A device with a reused admin password fails without any CVE at all, which is the 38% half of the DBIR finding.

If you also manage clients' coding agents, the threat.cafe early-access list applies the same known-bad-only principle to agent skills, MCP servers and packages.

Sources

#msp #cisa-kev #edge-devices #vulnerability-alerting #smb

All posts