NorthQuinn
Explore AVERY
AVERY Platform How It Works Interactive Demo Research Threat Intelligence Resources Founding Team About
Services
APT Detection and Hunting SOC Buildout and Optimization Network Forensics and Incident Response Threat Intelligence Integration Security Consulting and vCISO How Engagements Work Contact Client Portal Explore AVERY
Resources

Threat Intelligence Resources

Known exploited vulnerability data from CISA, and the research NorthQuinn publishes on detecting the adversaries behind it.

CISA KEV: Live Feed Refreshed Hourly NorthQuinn Research
—
Known Exploited CVEs
—
Added in Last 30 Days
—
Known Ransomware Use
Live KEV · CISA Known Exploited Vulnerabilities

Active exploits. Real deadlines.

Every vulnerability in this catalog has been confirmed as actively exploited in the wild. CISA requires federal civilian agencies to remediate each one by the listed due date. The threat applies to every organization.

Source: cisa.gov/kev

Fetching live data from CISA…

Published Research

NorthQuinn research

Technical papers on threat observation and on the detection methods behind AVERY and our open-source tools. Each states its limits, and corrections are published with a revision note.

Threat IntelligenceNQ-TIR-2026-001

Threat Actors in the Wild

Ten days of attacks against an internet-facing honeypot with an industrial control system persona, with indicators for defenders. Version 1.1, corrected October 2026.

Read the paper (PDF)
Detection EngineeringNQ-DER-2026-001

Beacon Detection Without a SIEM

Multi-signal correlation as a basis for low-false-positive command-and-control identification, with its trade-offs and limits stated. Version 1.1, corrected October 2026.

Read the paper (PDF)
Mobile Telephony ForensicsNQ-MTF-2026-001

Reconstructing Telephony Faults from the Radio Log

Per-slot event timelining of Android radio logs under an adversarial input model, with subscriber identifiers redacted by default.

Read the paper (PDF)
Planned

Intel Briefings

Short analyses of what significant KEV additions mean for detection: context, likely actors, and practical guidance. The first briefings are planned for Q1 2027.

All research
Open Source

Built in public. No vendor lock-in.

Every component of the detection architecture we deploy is open-source or open-standard, fully documented, and yours to own. No proprietary dependencies, no license fees, no lock-in.

Transparent architecture is not a marketing position. It is the only defensible approach when you are building detection capability meant to hold under real adversary pressure.

View NorthQuinn on GitHub
Common Questions

Frequently asked questions

What is the CISA KEV catalog?
The CISA Known Exploited Vulnerabilities catalog is the U.S. government's authoritative list of CVEs that have been confirmed as actively exploited in the wild. Federal agencies are required to patch KEV entries by the listed due date. For private sector organizations, the catalog is the single most reliable signal of which vulnerabilities threat actors are actually weaponizing right now, not theoretically.
How often is this feed updated?
CISA updates the KEV catalog continuously, typically multiple times per week. This page loads CISA's official Known Exploited Vulnerabilities catalog on each visit through our edge cache, which refreshes from CISA at most once an hour, so what you see is never more than an hour behind the catalog. If the feed is ever unavailable, the page says so and links to the catalog at CISA directly.
What does AVERY do with KEV data?
AVERY is designed to use CISA KEV as one input among its threat intelligence sources, so newly added vulnerabilities inform what it looks for. Specific implementation detail is shared with qualified organizations under NDA in technical briefings.
What does the Ransomware column mean?
CISA marks each KEV entry as "Known" when it has evidence the vulnerability has been used in ransomware campaigns, and "Unknown" otherwise. A "Yes" in the table means CISA lists it as Known. A dash means CISA has no confirmation either way, not that the vulnerability is safe to defer. Ransomware-linked entries are a sensible place to start remediation.
Why doesn't this table show CVSS severity?
The KEV catalog does not include CVSS scores, and we show only what CISA publishes. Being on the list already means exploitation has been confirmed in the wild, which matters more for prioritization than a base score. Each CVE ID links to its entry in the National Vulnerability Database (NVD), where the CVSS score and vector are listed.
How is AVERY different from a traditional SIEM?
Traditional SIEMs ingest logs and fire alerts when predefined rules match. AVERY is designed to work differently: it learns what is normal for each host, identity, and channel, and raises a finding only when several independent signals agree that something has drifted. That agreement requirement is designed to keep false positives low. Specific architecture and detection methodology are shared with qualified organizations under NDA.
Do you need to replace my existing tools to deploy AVERY?
No. AVERY is designed to integrate with your existing security stack through read-only sensor connections. It does not replace your existing SIEM or defensive tooling. It sits above the stack and provides the intelligence layer those tools lack. If your environment does not yet have modern defensive architecture in place, NorthQuinn can build it as part of an SOC buildout engagement.
Can I get intel briefings by email?
Intel briefings are launching in Q1 2027. When they go live, they will be available directly on this page and through an opt-in email distribution. To be notified when the first briefing publishes, reach out through the contact form and mention Intel Briefings.

Put this intelligence to work

AVERY is designed to correlate known-exploited vulnerabilities like these with what is actually happening on your network. Ask us how that works in your environment.

Request a Briefing