The list that matters
CISA's catalogue of vulnerabilities with confirmed active exploitation — not the CVE firehose.
Vulnerability intel
CISA KEV and zero-day vulnerability alerts
There is a short, authoritative list of the vulnerabilities attackers are actually exploiting: CISA's Known Exploited Vulnerabilities catalogue. XIBA watches it for you and raises an alert the day something new is added, so the most urgent vulnerabilities reach your team without you refreshing a government web page.
- No agent to install
- No credit card
- Read-only access
Synced daily
New entries become incidents within a day of being added.
Ransomware flagged
Entries tied to known ransomware campaigns are raised at critical severity.
Routed to your team
Through the same rules as the rest of your incidents.
xiba.ai/incidents
illustration- CRITICALSend to Teams
Lookalike registered: x1ba.ai
Mail records already configured · registrar and abuse contact resolved
- HIGHSend to Teams
MFA gap: 3 accounts
SMS only — counted as a weak method, not as enrolled
- TRIAGEDSend to Teams
Ticket #441050: “Odd popup during VPN sign-in”
Surfaced from the helpdesk queue with suggested steps
13 incident types · one queueacknowledge · resolve · escalate
1
The list that actually matters
Most vulnerability feeds are noise — thousands of CVEs a year, the vast majority never exploited. CISA's KEV catalogue is the opposite: a curated list of vulnerabilities with confirmed, active exploitation in the wild. If something is on it, it is being used right now.
For a small team, that list is the right thing to watch — and the wrong thing to watch by hand.
2
What XIBA does with it
XIBA syncs the KEV catalogue daily and raises an incident for each newly-added entry, so a vulnerability that became actively exploited yesterday is in your queue today.
- New KEV entries become incidents automatically — no configuration, no credentials to connect.
- Entries flagged by CISA as used in known ransomware campaigns are raised at critical severity.
- Each alert carries the affected vendor and product so you can judge relevance at a glance.
- Alerts route through the same rules as the rest of your incidents, to the channels and people you choose.
3
In one queue with everything else
A KEV alert lands in the same incident feed as your Microsoft 365, domain and infrastructure signals, in one severity language — so urgent vulnerability news is triaged the same way as everything else, not in a separate tab you forget to open.
What this does — and does not — do
XIBA alerts you to newly-added, actively-exploited vulnerabilities from the CISA KEV catalogue and names the affected vendor and product. It does not scan your systems or match entries against an inventory of what you run, so it tells you what is being exploited in the wild — not which of your specific machines are affected. Use the vendor and product in each alert to judge whether it touches your stack.
Common questions
What is the CISA KEV catalogue?
It is the US Cybersecurity and Infrastructure Security Agency's list of Known Exploited Vulnerabilities — vulnerabilities with confirmed active exploitation in the wild. It is the authoritative shortlist of what attackers are actually using, as opposed to the full, mostly-unexploited CVE firehose.
How quickly will I hear about a new one?
XIBA syncs the catalogue daily and raises an incident for each new entry, so a newly-exploited vulnerability reaches your queue within a day of being added.
Does XIBA scan our systems to tell us if we're affected?
No. It alerts on new KEV entries and names the affected vendor and product, but it does not scan your environment or match entries to an inventory of what you run. You use the vendor and product details to judge whether an alert applies to you.
Do we need to connect anything for this?
No. KEV monitoring is public and needs no credentials — it works with no configuration once you have an account.
See it against your own tenant
Connect read-only in minutes, watch the first incidents land, and remove it all yourself if it is not for you. Free tier, no card.