How do you keep up with the threat landscape and new vulnerabilities?

Sources, and what each is for:

• Vulnerability feeds — CISA's Known Exploited Vulnerabilities catalogue is the most useful single list, because it contains what is actively being exploited rather than everything ever published. Vendor advisories for your specific stack.
• Threat intelligence — sector-specific ISACs, and vendor reporting on the groups likely to target your industry.
• Practitioner community — security researchers, conference talks, and write-ups of real incidents, which teach far more than vulnerability counts.
• Hands-on practice — a lab, CTF exercises, or reproducing a published technique. Understanding an attack by performing it is different from reading about it.

How you turn it into action — the part that matters:

• Filter by exposure. A critical CVSS score in software you do not run is noise. Asset inventory is what makes triage possible.
• Prioritise on exploitability and exposure, not severity alone. An internet-facing service with a working public exploit outranks a higher-scored flaw on an internal system.
• Map to detection. Ask whether you would see it if it happened, and add the detection if not.

Note: MITRE ATT&CK is worth naming as the framework for mapping techniques to detections systematically rather than chasing individual headlines.