Known Exploited Doesn't Stay Exploited | Empirical Security

"Known exploited" is treated as a permanent state. The data says it isn't. If a vulnerability was exploited today, there's a 99.9% chance it's exploited again in the next 30 days. Go a year without observed activity and it's back at the base rate, as if it had never been exploited at all. CISA's KEV catalog has no last-observed field, and it only ever grows. Ed Bellis (CEO), Jay Jacobs (Chief Data Scientist) and Michael Roytman (CTO) of Empirical Security, the team behind Kenna Security and co-creators of EPSS, are back after a $25M Series A to talk about what Kenna couldn't finish: prioritization models trained per organization instead of one global score. Along the way: the 15,000-plus exploited CVEs that never make KEV and the 400-plus KEV entries their telemetry never sees; whether NVD gating enrichment on KEV hard-codes a stale signal into everyone's pipeline; the "dead vulnerability theory" of metadata bias; why their models are deterministic statistics rather than LLMs ("LLMs summarize the past really well; they don't predict"); a live on-air bet that 2026 ends with 120,000 CVEs; whether six years of exploitation data show any AI-acceleration signature yet (more discovery, flat actionable exploitation, a denominator growing faster than the numerator); what building EPSS as a public good taught them about probability and thresholds; and whether gated frontier models create a two-tier research world (Ed: "I don't think it matters at all"). Chapters: 00:00 – Known exploited isn't permanent: the premise, and a disclosure 01:26 – What Kenna proved, and what it couldn't solve 05:50 – The $25M Series A, and why the models aren't LLMs 09:11 – The KEV decay curve: 99.9% today, base rate in a year 13:25 – The third circle: exploited CVEs that KEV never lists 15:30 – NVD gates on KEV: stale signal, metadata bias, a data problem 24:17 – A last-observed field for KEV, and whether it tips off attackers 27:28 – Is AI accelerating exploitation? The 120,000-CVE bet 34:33 – LLMs summarize the past; forecasting models predict 40:59 – Lessons from building EPSS: probability, thresholds, donated data 50:23 – Gated frontier models and the two-tier research question 54:47 – Foundation vs. Radiant: targets of opportunity vs. targeted Links Empirical Security research: https://research.empiricalsecurity.com The KEV Paradox (Empirical Security, Jan 2026): https://research.empiricalsecurity.com/research/the-kev-paradox Looking for the AI vulnerability flood (Ben Edwards): https://research.empiricalsecurity.com/research/looking-for-the-ai-vulnerability-floodEPSS: https://www.first.org/epss/ CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalogListen on More episodes: https://www.youtube.com/@symantec/podcasts More research and expert perspectives: https://www.security.com Guests: Ed Bellis, CEO; Jay Jacobs, Chief Data Scientist; Michael Roytman, CTO — Empirical Security. Host: Dan Mellinger.SECURITY.COM The Podcast — In-depth intel. Real talk. Human factor.