Stop Patching Blindly: What CISA’s New Prioritization Approach Means for Federal Agencies
CISA shifts federal agencies from severity-based to risk-based vulnerability patching.
CISA has ended its weekly vulnerability bulletins, moving federal agencies to a risk-based approach for patching. The new model, outlined in BOD 26-04, prioritizes remediation based on factors like internet accessibility, active exploitation, automation potential, and attacker control, rather than solely on CVSS severity scores. This aims to address the growing volume of vulnerabilities and the acceleration of exploit development by AI.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CISA?
Get an email when a new story names CISA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonFederal agencies have historically relied on CVSS severity scores to prioritize patching, but this approach fails to account for real-world exploitability, internet exposure, and active attacker activity. CISA's BOD 26-04 directive formally shifts agencies toward a risk-based model that weighs factors such as whether a system is internet-accessible, whether exploitation is occurring in the wild, and whether AI-accelerated exploit development has shortened the remediation window. Blindly patching by CVSS score wastes resources on low-risk vulnerabilities while critical, actively exploited flaws may go unaddressed. As the volume of disclosed vulnerabilities continues to grow and AI tools help adversaries weaponize exploits faster, organizations that cannot intelligently triage risk will consistently fall behind attackers.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.