Smarter patching beats brute force

The Cybersecurity and Infrastructure Security Agency has issued a new binding directive that reshapes how federal civilian agencies prioritize software patches, aiming to speed fixes for the most dangerous flaws while allowing deferral of lower-risk issues as artificial intelligence accelerates both discovery and exploitation of vulnerabilities.

The shift comes as defenders fall further behind on basic remediation. According to Verizon’s 2026 Data Breach Investigations Report, only 26% of vulnerabilities on CISA’s Known Exploited Vulnerabilities Catalog were fully remediated by organizations in 2025, down from 38% the year before, and the median time to full resolution climbed to 43 days.

Under Binding Operational Directive 26-04, titled “Prioritizing Security Updates Based on Risk,” federal agencies are instructed to concentrate resources on vulnerabilities that pose the highest danger and may defer those deemed lower priority. The directive provides a risk-based playbook for patching and incident management intended to give defenders more clarity and speed.

CISA identifies four traits that elevate a vulnerability’s risk: it is exposed to the public internet; attackers can fully automate exploitation; successful exploitation grants full system control; and there is evidence of real-world abuse, such as inclusion in the KEV catalog.

Using that rubric, only the most critical issues fall into a three-day patch window. Flaws assessed as lower risk can be remediated on longer timelines, potentially pushed to the next scheduled system upgrade.

While the framework heavily emphasizes vulnerabilities at the network edge, the agency notes that it does not typically see threat actors initiating compromises of core networks via product flaws. Instead, adversaries frequently rely on exploitable configurations and valid credentials—a tactic known as living off the land—better countered through configuration hardening, network segmentation, and enforcement of phishing-resistant multi-factor authentication.

Early results suggest the approach can significantly reduce patching pressure. At one large civilian agency analyzed by CISA, roughly 1% of vulnerability instances landed in the three-day bucket, while more than 60% were deferred to the next upgrade cycle, allowing teams to address the most urgent exposures faster.

The directive is mandatory for federal civilian executive branch agencies and is framed as a step toward meeting AI-driven threats by helping organizations automate and scale vulnerability management and strengthen secure engineering practices. How well it works in practice will depend on rigorous asset inventories, timely threat intelligence, and disciplined change management to ensure that deferred fixes do not turn into long-term risk.