A lot of KEV response still collapses into one closure condition: the vulnerable system was patched. That works if exploitation never happened. It is weaker when the asset was exposed, telemetry is incomplete, or the system carries identity, remote-access, payment, or administrative authority.
A more useful split is to track two gates: “vulnerability remediated” and “compromise reasonably excluded or handled.” The first closes the entry path. The second asks whether an earlier exploit became persistence, stolen credentials, tokens, certificates, or lateral access.
The full decision model is here.
Where does your team draw the line between urgent vulnerability response and suspected incident?