CISA — Glossary | GetCoreTech

The longer version

The agency was created in 2018 as part of the Department of Homeland Security. It publishes advisories, maintains the Known Exploited Vulnerabilities catalog, runs free services such as vulnerability scanning for eligible organizations and coordinates responses to major incidents. It also funds the CVE program.

Its guidance is aimed at US government and critical infrastructure, but it is public and useful for anyone. Advisories often include indicators of compromise and concrete mitigations that you can use at once.

For defenders, the most practical output is the KEV catalog, because it turns a mass of published flaws into a list of those that are being used in attacks.

Follow its advisories and KEV feed, use the free services that fit your organization and check the indicators in its notices against your own logs.

Where we use “CISA”

CybersecurityCISA Adds Exploited GitLab and Cisco Flaws
Two exploited flaws hit CISA's KEV catalog on 29 October, but upgrading GitLab to the 12 October builds still leaves a second CVSS 10.0 flaw open. Here's what to patch, and in what order.
Nov 1, 2026Key term
CybersecurityGlobalProtect CVE-2026-0257 and Ransomware
Palo Alto's GlobalProtect flaw CVE-2026-0257 went from an advisory on 13 May to ransomware intrusions by June. This timeline separates what the documents show from what sources only report or claim.
Nov 1, 2026Key term
CybersecurityMicrosoft's Record Patch Tuesday: What More Than 1,400 CVEs Actually Mean
Microsoft's October 2026 Patch Tuesday listed about 1,413 CVEs, roughly eight times the previous monthly record. Here is what the count measures, who found the flaws, and how to turn the list into a patch order.
Nov 1, 2026Key term
CybersecurityPatch by Exploitation, Not CVSS
Sorting a patch queue by CVSS puts actively exploited flaws behind thousands that nobody is using. Four yes-or-no questions adapted from CISA's new directive give a small team a faster order.
Nov 1, 2026Key term
CybersecurityExploits Overtake Stolen Passwords
Verizon's 2026 DBIR puts exploitation first at 31%, ahead of credential abuse at 13%. The rise is real, but a new category and a changed taxonomy make the gap look wider than it is.
Nov 1, 2026
CybersecurityCitrix and Ivanti Edge Zero-Days: What to Patch Now
Citrix NetScaler and Ivanti Connect Secure were exploited before fixes existed, and NetScaler's 4 October fix builds are still affected by a later SAML flaw on appliances acting as an identity provider. Here are the builds to move to by 6 November and how to check for compromise.
Nov 1, 2026

The longer version

Where we use “CISA”

Get the Core in your inbox.