Every public CVE source answers a different question, and the fastest triage workflow assigns each one exactly one job: CISA’s Known Exploited Vulnerabilities catalog confirms that exploitation has already happened, EPSS sets a probability prior for the next 30 days, Cloudflare’s new Zero Wire briefings add per-CVE assessment context, and vendor advisories carry the actual remediation detail. Cloudflare launched Zero Wire on November 3, 2026 as a public vulnerability intelligence feed on Cloudflare Radar, and its stated reason for existing is a vendor claim worth naming up front: that AI is increasing both the volume and the speed of critical vulnerability discovery. Nothing in the available evidence measures that acceleration, and nothing yet measures Zero Wire’s own coverage, cadence, or briefing accuracy. What the independent research does measure is the environment the feed enters: roughly 212 CVEs published per day with a 21.1% annual growth rate, a KEV catalog that gates on confirmed exploitation evidence, and at least one study finding that EPSS scores trail KEV additions rather than front-run them. The practical consequence is that triage value has moved from data access to deployment-to-CVE mapping, and the teams that benefit most from any new feed are the ones that already know what they run.
What Cloudflare actually launched
Zero Wire is not a vulnerability database and does not try to be. Cloudflare’s launch post is explicit about scope: “Rather than a catalog of every CVE, Zero Wire complements vendor advisories and vulnerability databases, linking readers to the evidence and technical guidance needed to act.” The feed targets critical CVEs in Internet-facing software: web applications, the runtimes and libraries they depend on, and services exposed to the Internet, specifically the category where a proxy can help mitigate exploitation.
Each briefing is structured as an index card. In Cloudflare’s description, “each briefing explains the potential impact, which deployments should be investigated, what is known about exploitation, and the available mitigation and patching guidance,” and the cards link out to CVE records, research, exploitation evidence including CISA KEV, and vendor guidance. The post also draws a distinction that experienced triage teams already apply: severity and evidence of active exploitation are different attributes, and a decision needs both.
Two design choices deserve attention beyond the format. First, Cloudflare ships a pre-compiled prompt intended for the reader’s own AI agent, requesting a read-only assessment of deployed software, vendor fixes, exposure, and compensating controls, with per-asset evidence, unknowns, and next actions. Copying that prompt does not scan or change anything by itself; it is a structured way to ask an agent questions your inventory has to be able to answer. Second, Cloudflare is unusually candid about the limits of its own product category, stating that a dedicated protection such as WAF rules is “a compensating control for the traffic it covers, it is not a replacement for fixing vulnerable software. Blocking the requests can prevent exposed data from reaching an attacker, but it cannot undo actions already performed at the origin.”
All of this is vendor-stated as of November 3, 2026. No independent source has evaluated whether the briefings arrive fast, cover the right CVEs, or hold up on accuracy.
The volume problem is documented; the speed premise is not
The throughput pressure behind Zero Wire’s pitch is well supported. The GitHub Popularity Metric paper reports the 212-CVEs-per-day average and 21.1% annual growth, citing RogoLabs 2025. The same paper documents strain further down the pipeline: at its data collection, NVD had marked 94,568 of 332,207 CVEs as DEFERRED, meaning not prioritized for enrichment, and in 2026 NVD announced it would enrich only KEV-included, US-federal, and critical-software CVEs because of volume. Enrichment gaps at NVD propagate into every downstream feed and scoring system that consumes NVD data.
Patch capacity makes the arithmetic worse. The EPSS-KEV efficacy study reports that companies worldwide take between 88 and 208 days on average to patch vulnerabilities. Against a daily inflow in the hundreds, exhaustive remediation is not a strategy; explicit prioritization is the only option.
On the discovery side, the evidence is more modest than the launch rhetoric. An independent smart-contract study found that an LLM, Gemini 2.0 Pro, “not only identified the vulnerability but correctly deduced the multi-step attack vector involving a malicious fallback function,” in a case where the Slither static analyzer emitted only a generic warning. That supports the narrower claim that AI can surface complex, deeply nested flaws. The same paper warns of a trust gap from reliance on opaque model outputs, and it measures nothing about disclosure rates. Cloudflare’s volume-and-speed premise remains an assertion; the correct posture is to plan for continued growth in disclosure volume, which the data supports, without treating the AI-acceleration framing as established.
Assign each feed one job
Because each source carries a different bias and timing profile, the defensible workflow is layered, not substitutive. The table below formalizes the roles; the sections after it examine where each one fails.
| Source | The one question it answers | Documented bias or gap | Where it fits in triage |
|---|---|---|---|
| CISA KEV | Has this been exploited? | Gates on credible exploitation evidence; small catalog (1,513 CVEs at one paper’s data collection); arrives after exploitation begins | Confirmed-exploitation trigger: patch or mitigate now |
| EPSS | How likely is exploitation soon? | Probability prior, not confirmation; one study finds it lags KEV; volatile across model updates; vendor-feed blind spots | Rank-ordering the long tail within a patch cycle |
| Zero Wire | What does this CVE mean for Internet-facing deployments? | Vendor-selected scope (critical, Internet-facing, proxy-mitigable); coverage and cadence unmeasured | Assessment context when a briefing exists; absence is not a signal |
| Vendor advisories | How exactly do I fix or configure it? | Varies by vendor maturity; no cross-fleet prioritization | Remediation detail once a CVE is in scope |
The integration baseline for this layering already exists in the literature. The Vulnerability Management Chaining framework combines CVSS severity, EPSS prediction using the research-established 0.088 threshold, and KEV membership into one decision process, and cites published research showing that “EPSS significantly outperforms CVSS for vulnerability prioritization, achieving superior efficiency (proportion of prioritized vulnerabilities that are exploited) and coverage (proportion of exploited vulnerabilities that are prioritized).” Zero Wire slots into that framework as context, not as a new score.
KEV proves exploitation, after it starts
KEV’s strength is its certainty and its weakness is its timing. According to the GPM paper, “inclusion in KEV usually requires credible evidence of exploitation and is typically based on reliable government, industry, or open-source threat intelligence.” That evidence gate is what makes a KEV listing actionable without further debate. It is also what makes KEV structurally late: by definition, the exploitation has already been observed by someone. The same paper reports KEV’s coverage as low, 1,513 CVEs at its data collection, against a total CVE population in the hundreds of thousands.
So KEV is an exploitation-lag signal. When a CVE appears there, the question is closed and the work is urgent. But a queue ordered by KEV alone is a queue ordered by what attackers have already done, which is exactly the posture Zero Wire’s launch post argues against. The feed ecosystem needs something earlier in the timeline, which is the role EPSS was built for, with caveats.
EPSS is a prior, and a contested one
EPSS was introduced in 2019 as the first open, data-driven framework estimating the probability that a vulnerability is exploited in the wild, in the original formulation within the first twelve months after public disclosure, and “designed to be simple enough to be implemented by practitioners without specialized tools.” The current version estimates the probability of exploitation within the next 30 days relative to other vulnerabilities, and the GPM paper notes that EPSS version 5 integrated the GitHub Popularity Metric, a signal derived from exploit-repository activity on GitHub.
The counter-evidence is direct. The study of high-severity KEV CVEs concludes: “Once a CVE is added to CISA KEV, it is known to have been already exploited. In such a case, the EPSS score is not reflecting that and often times significantly lags the CISA KEV catalog addition.” Its sharpest example is CVE-2024-21762, which held a near-zero EPSS score for its entire six months despite KEV listing and exploitation evidence, a failure the authors suggest may trace to a blind spot in the vendor feeds EPSS consumes. The paper’s overall judgment is that EPSS “appears to be a trailing indicator of exploitation rather than a predictive system.” The chaining paper adds the milder version of the same warning: EPSS has inherent false positives and false negatives, and “scores may also exhibit volatility as new threat intelligence emerges or model updates occur.”
One study of high-severity KEV CVEs is not a settled verdict on EPSS as a whole, and the probability-prior use case survives the criticism. What does not survive is an EPSS-only patch strategy: the efficacy study warns that it can leave systems exposed while exploit code is publicly available. For teams that want to check the scores rather than trust them, calibration methodology exists. Work on probability-of-default model validation separates rank ability from calibration, meaning whether output probabilities match observed frequencies, evaluates with Brier score, and improves long-term calibration through time-series isotonic recalibration. That evidence comes from credit scoring, not vulnerability data, so treat it as a transferable audit method rather than a finding about EPSS itself.
Where Zero Wire fits, and what it cannot settle
Within this map, Zero Wire occupies the assessment-context slot: human-readable briefings that compress impact, affected deployment patterns, exploitation status, and mitigation guidance into one card, for the subset of CVEs Cloudflare selects. Its declared scope, critical and Internet-facing and proxy-mitigable, is also its selection bias. A briefing that exists is useful; a briefing that does not exist tells you nothing, the same way absence from KEV does not mean absence of exploitation.
That scope does align with where compensating controls work. Cloudflare’s own framing is that these are the vulnerabilities “where a proxy can help mitigate exploitation,” and the company’s caveat about compensating controls is worth treating as doctrine rather than marketing: request blocking covers the traffic it can inspect and cannot undo actions already performed at the origin. Encrypted or non-HTTP paths, post-exploitation behavior, and internal attack surfaces sit outside that control entirely. Patching remains the only complete remediation.
Can the feed keep up with AI-accelerated discovery? The honest answer is that the supplied evidence cannot say. Keeping up has at least three measurable dimensions: what fraction of genuinely critical Internet-facing CVEs get briefings, how long after disclosure they appear, and whether the briefings hold up on accuracy. None of these has an independent measurement yet. The volume side of the race is documented (212 per day, growing 21.1% annually per the GPM paper), but “critical Internet-facing” is a much smaller subset, and Cloudflare has not published selection criteria precise enough to estimate it. The question the title poses stays open, and any article claiming to have answered it would be speculating.
The bottleneck you actually control
Every feed above assumes you can answer the same question quickly: do we run this, and where. That is the assumption most likely to fail. A Zero Wire briefing that says which deployments should be investigated is only actionable if you can enumerate your deployments; KEV’s urgency is only useful if you can locate the affected software before the 88-to-208-day average patch window becomes your window too.
Cloudflare’s agent prompt is instructive here precisely because of what it asks for: per-asset evidence about deployed software, exposure, and compensating controls, with unknowns listed explicitly. An agent handed that prompt against an accurate service inventory produces a triage worksheet. The same prompt against a stale CMDB produces confident-sounding fiction, which is the trust gap the Zer0n paper flags about opaque model outputs in a different context.
This is the second-order effect of disclosure growth that the feed announcements do not emphasize: as context-poor signals become cheap and abundant, the scarce input becomes the mapping from CVE to your own assets. More feed subscriptions cannot substitute for that mapping. At current inflow rates, I would put the next unit of budget into inventory accuracy before adding another intelligence source, with one condition: if your exposure is heavily proxied web infrastructure and you lack any assessment-context layer today, Zero Wire is cheap to adopt and scoped to exactly that case, so trial it on that basis rather than on the AI-discovery premise.
What to measure yourself
Until independent evaluations exist, a few bounded checks would establish whether Zero Wire earns its slot in the ordering. Track the lag between a critical Internet-facing CVE’s disclosure and its briefing across a few months, note which KEV additions in scope never receive a card, and spot-check briefing claims against the linked vendor advisories. None of that requires special access; it requires the same discipline this article recommends for EPSS, which is treating every feed as a hypothesis about the world and auditing it against outcomes you can observe. The feeds will keep multiplying. The inventory, and the habit of checking, are what make any of them worth reading.
Frequently Asked Questions
What is the scope of Cloudflare Zero Wire briefings?
The feed targets critical CVEs in Internet-facing software: web applications, the runtimes and libraries they depend on, and services exposed to the Internet, specifically the category where a proxy can help mitigate exploitation.
How long does it take companies to patch vulnerabilities on average?
The EPSS-KEV efficacy study reports that companies worldwide take between 88 and 208 days on average to patch vulnerabilities.
What does the Cloudflare agent prompt request?
Cloudflare ships a pre-compiled prompt intended for the reader’s own AI agent, requesting a read-only assessment of deployed software, vendor fixes, exposure, and compensating controls, with per-asset evidence, unknowns, and next actions.
Join the discussion
Share a useful perspective or ask a question about this article.