Track record

What right means

An early Act now is right when CISA or VulnCheck lists the flaw as exploited within 30 days of our call. It is wrong when 30 days pass with no listing. Until then it is pending. Calls made after a listing are not scored, because they cannot be wrong.

KEV is a strict test. Some flaws are exploited and never listed, so the real rate is likely higher than what we show. We count each flaw once, from the first time the site rated it Act now. A flaw that joins a group of listed flaws never borrows the group's earlier call.

Live since Oct 24, 2026

Every early Act now call the site has made, scored against KEV. An early call is one made before CISA or VulnCheck listed the flaw as exploited. Updated with every events sync.

100 other Act now calls came on or after the listing day. Those are right by construction, so they are not scored. Watch or higher calls followed by a listing within 90 days: 2 right, 0 wrong, 37 pending.

By rules version

The bar spans the range the true rate likely falls in (a 95% interval). The mark is the measured rate. Backtest rates are weighted to the full population of CVEs. How the backtest works and its limits are in the methodology.

1. v3RELEASED NOV 8, 2026ACTIVE

   Verdicts are unchanged from v2. Inside Act now, an Act today tier marks flaws with exploitation confirmed in the last 14 days on an internet-facing product, with ransomware use or with public attack tools, and every event gets a 0 to 11 ranking score with one line per factor.

   BACKTEST, SAME VERDICTS AS V2 · APR 1, 2025 TO OCT 1, 2026

   Early Act now right within 30 days, whole window43% (35 to 53%; 49 of 113)

   Same, on the held-out months (APR 1, 2026 on)35% (21 to 53%; 11 of 31)

   KEV listings with an Act now before the listing day15% (12 to 19%; 63 of 419)

   Median lead of those early calls: 4 days.

   LIVE

   No early Act now calls yet.

2. v2RELEASED OCT 24, 2026

   An early Act now needs two separate exploitation reports, or one report plus attack attempts seen by honeypots.

   BACKTEST · APR 1, 2025 TO OCT 1, 2026

   Early Act now right within 30 days, whole window43% (35 to 53%; 49 of 113)

   Same, on the held-out months (APR 1, 2026 on)35% (21 to 53%; 11 of 31)

   KEV listings with an Act now before the listing day15% (12 to 19%; 63 of 419)

   Median lead of those early calls: 4 days.

   LIVE

   2 early calls. 2 right, 0 wrong (100%, 34 to 100%).

3. v1RELEASED OCT 24, 2026

   Designed from the first backtest. Reported exploitation of a CVE 90 days old or newer is Act now, and confirmed exploitation gets two more reasons to be urgent.

   BACKTEST · APR 1, 2025 TO OCT 1, 2026

   Early Act now right within 30 days, whole window18% (14 to 22%; 58 of 325)

   Same, on the held-out months (APR 1, 2026 on)22% (14 to 31%; 20 of 93)

   KEV listings with an Act now before the listing day19% (15 to 23%; 79 of 419)

   Median lead of those early calls: 5 days.

   LIVE

   No early Act now calls yet.

4. v0RELEASED OCT 24, 2026

   The first rules, written before any testing. Confirmed exploitation plus an urgency factor is Act now, and so is reported exploitation with ready-made attack tools.

   BACKTEST · APR 1, 2025 TO OCT 1, 2026

   Early Act now right within 30 days, whole window16% (10 to 24%; 16 of 101)

   Same, on the held-out months (APR 1, 2026 on)7% (3 to 18%; 4 of 54)

   KEV listings with an Act now before the listing day11% (8 to 14%; 44 of 419)

   Median lead of those early calls: 58.5 days.

   LIVE

   No early Act now calls yet.

Every early call

Newest first. Each row links to the event page and its evidence.

1. OCT 24, 2026 · v2RIGHT
   PHP: 2 flaws used in attacks; attackers can run their own codeCVE-2026-109618 · KEV OCT 26, 2026, 2 days later
2. OCT 24, 2026 · v2RIGHT
   PHP: 2 flaws used in attacks; attackers can run their own codeCVE-2026-109619 · KEV OCT 26, 2026, 2 days later

For agents

The same numbers, with every call, are JSON at /api/v1/track-record. The rules and their history are on the methodology page.