[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSVc_780I6p-od-7wtPU0FW4fLwUONIrHVw74Uwp3ybU":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"9e11d30b-a903-4fef-b250-26401ead976e","Stop Patching Blindly: What CISA’s New Prioritization Approach Means for Federal Agencies","stop-patching-blindly-what-cisa-s-new-prioritization-approach-means-for-federal-1cf4fa","CISA's BOD 26-04 moves federal agencies from severity-based patching to risk-based prioritization. Here's how validation and verification show which exposures to fix first and prove the fixes worked.","CISA has ended its weekly vulnerability bulletins, moving federal agencies to a risk-based approach for patching. The new model, outlined in BOD 26-04, prioritizes remediation based on factors like internet accessibility, active exploitation, automation potential, and attacker control, rather than solely on CVSS severity scores. This aims to address the growing volume of vulnerabilities and the acceleration of exploit development by AI.","CISA shifts federal agencies from severity-based to risk-based vulnerability patching.","https:\u002F\u002Fhorizon3.ai\u002Fintelligence\u002Fblogs\u002Fcisa-bod-26-04-stop-patching-blindly\u002F","https:\u002F\u002Fhorizon3.ai\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002FWebsite-Preview-Image_1200x628.png","2026-11-10T13:15:00+00:00","2026-11-10T14:00:12.660308+00:00",7,[17,20],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":22},"AI","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"217d3263-c763-41ca-875e-06901f522fe0","NIST","nist",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":44,"vendors":127},[45,74,99],{"slug":46,"name":47,"problem":48,"products":49},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":75,"name":76,"problem":77,"products":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":75,"product_name":96,"url":97,"description":98},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":100,"name":101,"problem":102,"products":103},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":122,"url":125,"description":126},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":138},"risk-based-patching-replaces-cvss-only-prioritization-for-federal-agencies","Risk-Based Patching Replaces CVSS-Only Prioritization for Federal Agencies","Federal agencies have historically relied on CVSS severity scores to prioritize patching, but this approach fails to account for real-world exploitability, internet exposure, and active attacker activity. CISA's BOD 26-04 directive formally shifts agencies toward a risk-based model that weighs factors such as whether a system is internet-accessible, whether exploitation is occurring in the wild, and whether AI-accelerated exploit development has shortened the remediation window. Blindly patching by CVSS score wastes resources on low-risk vulnerabilities while critical, actively exploited flaws may go unaddressed. As the volume of disclosed vulnerabilities continues to grow and AI tools help adversaries weaponize exploits faster, organizations that cannot intelligently triage risk will consistently fall behind attackers.",[133,134,135,136,137],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 ID.RA-01: Asset Vulnerabilities Are Identified and Communicated","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":139,"NIST SP 800-53 SI-2: Flaw Remediation":140,"CIS Control 7: Continuous Vulnerability Management (v8)":141,"NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning":142,"NIST CSF 2.0 ID.RA-01: Asset Vulnerabilities Are Identified and Communicated":143},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure practices, requiring entities to manage and remediate vulnerabilities in a structured way rather than relying solely on generic severity scores.","SI-2 mandates that organizations identify, report, and correct system flaws within organizationally defined time periods based on risk, directly aligning with BOD 26-04's risk-tiered remediation timelines.","CIS Control 7 requires organizations to continuously assess and prioritize vulnerability remediation based on risk, which is precisely the shift CISA's BOD 26-04 mandates away from CVSS-only patching.","RA-5 requires organizations to scan for vulnerabilities, analyze results, and prioritize remediation — the control explicitly supports risk-informed triage rather than severity-score-only ordering.","This category requires that vulnerabilities in assets be continuously identified and communicated, forming the foundation for the exposure-aware, context-rich prioritization model CISA is now mandating."]