Why does an incident say "Exploited" or "Blocked" when CVE Shield shows a different status for that CVE?

 Incidents and CVE Shield track different things. An incident's result describes a single attack event, and it can be Exploited, Suspicious, Blocked, or Probed. CVE Shield's status describes a CVE's state over time, and it can be Not seen, Exposed, or Exploited. The same word doesn't mean the same thing in both places. CVE Shield doesn't block anything on any tier at launch, so CVE Shield-related incidents will show up as Exploited, Suspicious, or Probed, never Blocked.

See: View incidents (Northstar) (product docs: https://docs.contrastsecurity.com/en/view-incidents.html)