About

kevmap answers one question: for a vulnerability that is actively being exploited right now, what do we actually know about detecting it?

What it is

A static join of four public sources — CISA's KEV catalogue, MITRE ATT&CK, CTID's CVE → ATT&CK mappings, and SigmaHQ — rebuilt on a schedule, with every number computed from the sources and every break in the chain shown rather than papered over. Most tools in this space imply more knowledge than exists. This one states the boundary of what is publicly known and does not cross it. A vulnerability with no published mapping is shown as unmapped, not as a guess dressed up in a technique ID.

What it is not

It answers questions about the world. It never accepts your environment. There is no asset upload, no inventory, no "tell us what you run and we'll prioritise", no accounts. The moment a tool like this takes a customer's estate it becomes a different product with operational and confidentiality obligations that a free, static site cannot carry. Public knowledge belongs here; your environment does not. If you want to apply this to your estate, the dataset is published precisely so you can do that on your side.

Why static

No database, no server, no login. A build step fetches the sources, computes everything, and emits HTML and JSON. A free tool with an operational burden dies; the constraint is what lets it run unattended for years. It also means no cookies, no tracking, no consent banner — and nothing you type into the search box leaves your browser.

What would change the numbers

CTID publishing a new KEV mapping file. ATT&CK releasing a new version. Sigma contributors tagging rules for the techniques that currently have none. Each is picked up automatically and shows on /changes.

Contact

See the footer. Corrections to a number are taken seriously; every number has a path back to a source on /method, so say which step is wrong.