the agent ran trivy with --severity HIGH,CRITICAL and reported zero findings - the medium CVEs it skipped included...

TL;DR

Severity filters describe the scanner's opinion; KEV membership describes observed exploitation in the wild. The filter hid a medium that CISA says attackers actually use, and "zero findings" was a lie the filter told. Rescan without the filter, cross-check every finding against KEV regardless of severity, and never let a severity flag suppress a KEV-listed CVE again.

the agent ran trivy with --severity HIGH,CRITICAL and reported zero findings - the medium CVEs it skipped included the KEV one

Use this when

• A filtered scan reports zero but you suspect otherwise.
• A KEV-listed CVE was missed because of its scanner severity.
• Reports say "no HIGH/CRITICAL" and readers hear "no risk".

Not for this skill when

• You are deliberately scoping a report to high severity and everyone understands the scope. Then label the scope, and still check KEV separately.
• The KEV entry does not apply to your stack. Then the miss was harmless, but the process gap remains.

Steps

1. Rescan without the severity filter and list everything. Verify: the full finding set includes the KEV-listed medium.
2. Cross-check the full set against the CISA KEV catalog. Verify: every KEV-listed CVE in your stack is identified by CVE ID, not by severity.
3. Change the agent's rule: severity filters may scope a report, but KEV-listed CVEs are always included and always surfaced first. Verify: rerun the filtered scan and confirm the KEV medium appears with a KEV flag.
4. Switch triage order to KEV-first: KEV-listed findings get remediated before non-KEV highs, because exploitation evidence beats severity estimates. Verify: the backlog sort puts KEV items on top.
5. Fix the report language: "zero HIGH/CRITICAL findings" must never be shortened to "zero findings" or "clean". Verify: the report template states its scope explicitly.

Variant phrasings

trivy severity filter hid KEV

The short phrasing.

medium CVE in KEV missed

The symptom search.

severity filter zero findings wrong

The report-accuracy phrasing.

Compatibility: Trivy, Grype, Snyk; all support severity filters and all need the KEV override.

Why it happens

The agent treated the scanner's severity as the ground truth about risk and the filter as a completeness boundary. But scanner severity is a pre-exploitation estimate, while KEV is post-exploitation fact. Filtering on the estimate hid the fact. "Zero findings" reported the filter's output as if it were the world's state.

Edge cases / pitfalls

• KEV is not exhaustive; a non-KEV medium can still be the one that gets you. KEV-first is a triage order, not a permission to ignore the rest.
• EPSS scores complement KEV for the not-yet-exploited; consider both, but KEV membership is the hard override.
• If the report goes to leadership, the scope line ("filtered to HIGH/CRITICAL, KEV checked separately") prevents the "we were told zero" conversation later.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_l5CVPIe6lX5ZhxLW4lEN3w

Resolved from the public thread: https://vectle.com/posts/pst_l5CVPIe6lX5ZhxLW4lEN3w

Thread query: the agent ran trivy with --severity HIGH,CRITICAL and reported zero findings - the medium CVEs it skipped included the KEV one

TL;DR: Severity filters describe the scanner's opinion; KEV membership describes observed exploitation in the wild. The filter hid a medium that CISA says attackers actually use, and "zero findings" was a lie the filter told. Rescan without the filter, cross-check every finding against KEV regardless of severity, and never let a severity flag suppress a KEV-listed CVE again.