Security news arrives as a stream of CVE numbers. Most of them do not matter to a given company, and a few matter a great deal. The useful filter is CISA’s Known Exploited Vulnerabilities catalog: a bug only goes on it when CISA has evidence that attackers are using it. Each entry carries a due date that binds federal civilian agencies under Binding Operational Directive 26-04. Private companies are not bound by those dates, but boards, auditors and insurers increasingly treat them as the benchmark for a reasonable response.
Circuit & Capital covers catalog additions that reach ordinary businesses, and writes them for the people who sign off on the response: the CFO who owns the contracts and the CISO who owns the controls. Each briefing gives the dates, the affected versions confirmed against the vendor’s advisory, and the questions to put to whoever runs the system. Increasingly that is not your own team. Storefronts are run by agencies, network consoles by managed providers, and libraries like PHP or Brotli ship inside products you bought. The work is often a vendor inventory and a contract question, not only a patch.
The guides on this page cover the controls that sit around those bugs. How to ask a vendor for a software bill of materials that meets CISA’s 2026 minimum elements. How to keep a risk exception register where every gap has an owner, a funded fix and an expiry date, and where known-exploited bugs, MFA, backups and EDR are never waived. What a cyber insurer will still ask at renewal. And how to prepare for the SEC’s four-business-day Form 8-K clock, which starts when the company decides an incident is material.
The free tools turn those guides into worksheets that run in the browser and keep your data on your device. Each now has a free download, a CSV, spreadsheet, PDF or checklist, so you can keep a copy in the place your auditors expect.
Everything here follows the site’s editorial standards: every fact is checked against a primary source such as the CISA catalog, the vendor advisory or NVD, and anything we cannot confirm is left out. Corrections are logged publicly.
Briefings
- WordPress is on the exploited catalog. Get to 7.1.4 this week. · November 3, 2026
- Three exploited bugs, three deadlines: Ivanti, GitLab and Cisco VPN · October 31, 2026
- CISA added Magento and a compression library. Ask who owns the patch. · October 28, 2026
- The SEC’s 2027 exam list names deepfakes and vendor oversight · October 28, 2026
- PHP2Shell was probed before the patch · October 22, 2026
- The BeyondTrust bug was used before the patch · October 21, 2026
- Citrix NetScaler is on the exploited catalog again
- CISA listed three bugs attackers are already using
- The software ingredients list now covers the suite
- The SEC clock starts when you decide it matters
- Five moves Gartner wants from CISOs before 2027
- Cyber insurance got cheaper. The questionnaire did not.
Who this page is for, and how to use it
This page is for security and IT managers, and for the CFOs and general counsel who share their decisions. Check the newest briefings first for bugs CISA says are already exploited, then use the guides to set up the standing processes: SBOM requests, a risk exception register and a rehearsed materiality decision.
Guides
- Ask a vendor for an SBOM
- How to build a risk exception register
- How to build an IT risk register in Excel
- What a cyber insurer will still ask
- Cyber insurance checklist for mid-market IT budgets
- Before the Form 8-K clock
- Stop using a voice as approval
- The cloud shared-responsibility checklist
- Questions before a post-quantum pilot
Tools and free downloads
- Risk exception register · free CSV template
- SBOM request pack · free checklist
- SEC 8-K materiality worksheet · free PDF worksheet
Other topics: Renewals and SaaS spend · AI costs · All topics