[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd3uz7BK-Vrn3sVlAQMG5Qzx3qXZFb8MH0dgIXDLS-p8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"46069cac-22a8-4e8d-ac18-2451d959b419","risk-based-patching-replaces-cvss-only-prioritization-for-federal-agencies","9e11d30b-a903-4fef-b250-26401ead976e","Risk-Based Patching Replaces CVSS-Only Prioritization for Federal Agencies","Federal agencies have historically relied on CVSS severity scores to prioritize patching, but this approach fails to account for real-world exploitability, internet exposure, and active attacker activity. CISA's BOD 26-04 directive formally shifts agencies toward a risk-based model that weighs factors such as whether a system is internet-accessible, whether exploitation is occurring in the wild, and whether AI-accelerated exploit development has shortened the remediation window. Blindly patching by CVSS score wastes resources on low-risk vulnerabilities while critical, actively exploited flaws may go unaddressed. As the volume of disclosed vulnerabilities continues to grow and AI tools help adversaries weaponize exploits faster, organizations that cannot intelligently triage risk will consistently fall behind attackers.","**Immediate actions:**\n- Build or update an asset inventory that tags every system as internet-facing or internal so exposure can be factored into patch priority.\n- Cross-reference open vulnerabilities against CISA's Known Exploited Vulnerabilities (KEV) catalog daily to surface actively exploited flaws before CVSS-only queues surface them.\n\n**Long-term improvements:**\n- Adopt a formal risk-scoring model that combines CVSS, EPSS (Exploit Prediction Scoring System), internet exposure, and asset criticality to drive remediation SLAs.\n- Establish tiered patching SLAs (e.g., 24 hours for KEV-listed internet-facing flaws, 72 hours for high-risk internal systems) rather than a single organization-wide patch cycle.\n- Integrate threat intelligence feeds to detect when new exploit code for unpatched vulnerabilities is published, triggering an emergency patch review.\n\n**Detection measures:**\n- Deploy continuous vulnerability scanning on all internet-facing assets so newly disclosed CVEs are matched against the live environment within hours, not weeks.\n- Instrument patch deployment pipelines to produce metrics on mean-time-to-remediate per asset tier, enabling leadership to verify that risk-based SLAs are being met.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 ID.RA-01: Asset Vulnerabilities Are Identified and Communicated","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"CIS Control 7: Continuous Vulnerability Management (v8)":20,"NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning":21,"NIST CSF 2.0 ID.RA-01: Asset Vulnerabilities Are Identified and Communicated":22},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure practices, requiring entities to manage and remediate vulnerabilities in a structured way rather than relying solely on generic severity scores.","SI-2 mandates that organizations identify, report, and correct system flaws within organizationally defined time periods based on risk, directly aligning with BOD 26-04's risk-tiered remediation timelines.","CIS Control 7 requires organizations to continuously assess and prioritize vulnerability remediation based on risk, which is precisely the shift CISA's BOD 26-04 mandates away from CVSS-only patching.","RA-5 requires organizations to scan for vulnerabilities, analyze results, and prioritize remediation — the control explicitly supports risk-informed triage rather than severity-score-only ordering.","This category requires that vulnerabilities in assets be continuously identified and communicated, forming the foundation for the exposure-aware, context-rich prioritization model CISA is now mandating.","published","2026-11-10T15:22:37.731951+00:00","2026-11-10T15:22:37.72+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fhorizon3.ai\u002Fintelligence\u002Fblogs\u002Fcisa-bod-26-04-stop-patching-blindly\u002F","stop-patching-blindly-what-cisa-s-new-prioritization-approach-means-for-federal-1cf4fa","Stop Patching Blindly: What CISA’s New Prioritization Approach Means for Federal Agencies",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,51],{"slug":34,"name":46,"problem":47},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":49,"problem":50},"Automated patch management","Known holes get closed in days, not months.",{"slug":52,"name":53,"problem":54},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]