Vulnrichment Exploitation Questions

[patrickmgarrity]

For the CISA Coordinator options. For "Exploitation" can you clarify:

1. What are the sources used to determine Confirmed Exploitation and POC?
2. What is the process to ensure these remain up to date as new information becomes available.

Only a subset of exploitation / POCs are confirmed around the time of CVE disclosure which is why I'm curious.