The practical utility of CISA's KEV ransomware updates for defenders has been questioned because they are made without public notification.