## TL;DR
Severity filters describe the scanner's opinion; KEV membership describes observed exploitation in the wild. The filter hid a medium that CISA says attackers actually use, and "zero findings" was a lie the filter told. Rescan without the filter, cross-check every finding against KEV regardless of severity, and never let a severity flag suppress a KEV-listed CVE again.

```text
the agent ran trivy with --severity HIGH,CRITICAL and reported zero findings - the medium CVEs it skipped included the KEV one
```

## Use this when
- A filtered scan reports zero but you suspect otherwise.
- A KEV-listed CVE was missed because of its scanner severity.
- Reports say "no HIGH/CRITICAL" and readers hear "no risk".

## Not for this skill when
- You are deliberately scoping a report to high severity and everyone understands the scope. Then label the scope, and still check KEV separately.
- The KEV entry does not apply to your stack. Then the miss was harmless, but the process gap remains.

## Steps
1. Rescan without the severity filter and list everything. Verify: the full finding set includes the KEV-listed medium.
2. Cross-check the full set against the CISA KEV catalog. Verify: every KEV-listed CVE in your stack is identified by CVE ID, not by severity.
3. Change the agent's rule: severity filters may scope a report, but KEV-listed CVEs are always included and always surfaced first. Verify: rerun the filtered scan and confirm the KEV medium appears with a KEV flag.
4. Switch triage order to KEV-first: KEV-listed findings get remediated before non-KEV highs, because exploitation evidence beats severity estimates. Verify: the backlog sort puts KEV items on top.
5. Fix the report language: "zero HIGH/CRITICAL findings" must never be shortened to "zero findings" or "clean". Verify: the report template states its scope explicitly.

## Variant phrasings
### trivy severity filter hid KEV
The short phrasing.
### medium CVE in KEV missed
The symptom search.
### severity filter zero findings wrong
The report-accuracy phrasing.

Compatibility: Trivy, Grype, Snyk; all support severity filters and all need the KEV override.

## Why it happens
The agent treated the scanner's severity as the ground truth about risk and the filter as a completeness boundary. But scanner severity is a pre-exploitation estimate, while KEV is post-exploitation fact. Filtering on the estimate hid the fact. "Zero findings" reported the filter's output as if it were the world's state.

## Edge cases / pitfalls
- KEV is not exhaustive; a non-KEV medium can still be the one that gets you. KEV-first is a triage order, not a permission to ignore the rest.
- EPSS scores complement KEV for the not-yet-exploited; consider both, but KEV membership is the hard override.
- If the report goes to leadership, the scope line ("filtered to HIGH/CRITICAL, KEV checked separately") prevents the "we were told zero" conversation later.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_l5CVPIe6lX5ZhxLW4lEN3w