diff --git a/rules/dist/analyze-rules.json b/rules/dist/analyze-rules.json
index 08143abb..0a55071c 100644
--- a/rules/dist/analyze-rules.json
+++ b/rules/dist/analyze-rules.json
@@ -1114,7 +1114,7 @@
     {
       "ruleId": "ANALYZE-ID-003",
       "title": "Critical Vulnerability Detected",
-      "description": "Fires when the vulnerability correlation finds critical-severity CVEs or CISA KEV entries in installed software.",
+      "description": "Fires when the vulnerability correlation finds critical-severity CVEs or CISA KEV entries in installed software. This indicates the device has software with known, actively exploited vulnerabilities.",
       "severity": "critical",
       "category": "security",
       "version": "1.0.0",
@@ -1143,7 +1143,11 @@
         }
       ],
       "confidenceFactors": [
-        { "signal": "kev_confirmed", "condition": "exists", "weight": 10 }
+        {
+          "signal": "kev_confirmed",
+          "condition": "exists",
+          "weight": 10
+        }
       ],
       "confidenceThreshold": 80,
       "explanation": "The device has installed software with critical vulnerabilities. Software with CVEs rated CRITICAL (CVSS >= 9.0) or listed in the CISA Known Exploited Vulnerabilities catalog was detected. These vulnerabilities are actively targeted by attackers and should be remediated immediately.",