kev-exploitation-stickiness

io.github.pduggusa/dugganusa-threat-intel · Verify this server

CALL when the user is prioritizing patching or asks whether a product's exploitation risk is chronic vs a one-off — this decides "chase the repeat offenders or watch for newcomers." Does in-the-wild exploitation risk STICK to proven products, or SPREAD to new ones? Analyzes CISA KEV: correlates each product's historical known-exploited count against its RECENT KEV additions (Spearman rho), and splits recent additions into repeat-offenders (products with a prior KEV) vs first-time products. Answers "how should I prioritize patching — chase the chronic offenders, or watch for newcomers?" The honest finding: risk is roughly half-sticky (rho ~0.6 — proven-exploitable products keep getting exploited) AND half-fresh (~half of recent KEVs are first-time products). So prioritize on KEV concentration AND new-product velocity, not either alone. 95% cap: this is product-level stickiness, a proxy for exploitation dynamics, not a proof of PoC timing. Public read (no auth). Pass {"days": N} for the recent window (30-720, default 180).