{"slug": "stop-patching-blindly-what-cisas-new-prioritization-approach-means-for-federal", "title": "Stop Patching Blindly: What CISA’s New Prioritization Approach Means for Federal Agencies", "summary": "CISA ended its weekly vulnerability bulletins on September 28, 2026, shifting federal civilian agencies from CVSS severity-based patching to risk-based prioritization under Binding Operational Directive 26-04, \"Prioritizing Security Updates Based on Risk.\" The directive sets remediation timelines on four factors: whether the affected asset is internet-accessible, whether the vulnerability is known to be actively exploited, whether exploitation can be automated, and the level of control an attacker could gain. CISA branch chief for vulnerability response and coordination Lindsey Cerkovnik said \"Not all vulnerabilities matter. Not all vulnerabilities that do matter matter at the same level for you and your organization,\" as the agency points to growing vulnerability volume and AI accelerating both discovery and attackers' ability to operationalize exploits.", "body_md": "For more than two decades, the Cybersecurity and Infrastructure Security Agency (CISA) published a weekly bulletin listing newly disclosed vulnerabilities, their CVE identifiers, severity scores, and brief descriptions. On September 28, 2026, those bulletins ended and with that change it marked the move from just measuring the vulnerability discovery to addressing the exploitations that need to be validated.\n\n[CISA says the decision](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42b055b) reflects its shift from severity-based vulnerability management to a modern, risk-based approach. Instead of treating a CVSS score as the primary measure of urgency, the agency wants federal teams to prioritize remediation using real-world evidence of exploitation and exposure.\n\nThe reason is straightforward: vulnerability volume continues to grow, and AI is accelerating both vulnerability discovery and attackers’ ability to operationalize new exploits. Defenders cannot patch everything at once. They need a better way to determine what matters most.\n\nAs Lindsey Cerkovnik, CISA’s branch chief for vulnerability response and coordination, [recently put it](https://www.cybersecuritydive.com/news/cisa-vulnerability-bulletins-sunset-prioritization/830779/): *“Not all vulnerabilities matter. Not all vulnerabilities that do matter matter at the same level for you and your organization.”* That is more than a change in patching timelines. It signals a broader evolution in how federal agencies should think about cyber risk.\n\n## Severity Alone Cannot Determine Priority\n\nAgencies now need to discover weaknesses, maintain accurate asset inventories, monitor the Known Exploited Vulnerabilities (KEV) Catalog, and patch affected systems.\n\nThe problem with just doing vulnerability discovery was it becomes the basis for prioritization without enough context.\n\nThe Common Vulnerability Scoring System [(CVSS)](https://nvd.nist.gov/vuln-metrics/cvss) describes the technical severity of a vulnerability under defined conditions. It does not show whether an affected system is accessible to an attacker, whether compensating controls prevent exploitation, or what an attacker could reach after gaining access.\n\nThe reality is that two agencies can operate the same vulnerable product and face very different levels of risk. In one environment, the affected system may be isolated and protected by effective controls. In another, the same weakness may provide initial access, expose privileged credentials, and create a path to systems supporting critical operations. The vulnerability is the same. The exposure and potential mission impact are not.\n\nOther related international examples include the [EU’s Cyber Resilience Act](https://www.theregister.com/security/2026/09/11/eus-cyber-resilience-act-starts-the-24-hour-vulnerability-clock/5295821) that ensures manufacturers now disclose actively exploited flaws and severe security incidents through ENISA’s new reporting platform to ensure proper disclosure on exploitation to aid in that prioritization.\n\nWhen every critical finding enters the same remediation queue, teams can spend limited time patching vulnerabilities that pose little immediate risk while more consequential exposures remain unresolved. That is the challenge with patching by severity alone: teams are forced to make remediation decisions without enough evidence about attacker opportunity and impact.\n\n## Prioritizing Security Updates Based on Risk\n\n[CISA’s Binding Operational Directive 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk), *Prioritizing Security Updates Based on Risk*, gives federal civilian agencies a more practical model.\n\nThe directive bases remediation timelines on four factors:\n\n- Whether the affected asset is accessible from the internet\n- Whether the vulnerability is known to be actively exploited\n- Whether exploitation can be automated\n- The level of control an attacker could gain through successful exploitation\n\nTogether, these factors provide a stronger indication of urgency than severity scores alone. An actively exploited, automatable vulnerability that could provide control of an internet-facing system warrants a different response than an equally severe weakness on an internal system that attackers cannot reach.\n\nThis helps agencies direct limited resources toward the vulnerabilities most likely to create immediate risk. But it also raises the next set of questions.\n\nIs the weakness exploitable in this specific environment? What could an attacker do with the resulting access? Could it be combined with exposed credentials, identity misconfigurations, or other security gaps? What systems and data could an attacker ultimately reach?\n\nExternal intelligence and standardized risk factors cannot fully answer those questions. Agencies need evidence from inside their own environments.\n\n## Exposure Management for the Win\n\nThis is where the conversation moves from vulnerability management toward exposure management.\n\nAttackers do not experience an environment as a list of isolated CVEs. They find combinations of vulnerabilities, credentials, misconfigurations, identity relationships, and control gaps that allow them to progress toward a target.\n\nA vulnerability that appears critical on its own may lead nowhere. A series of individually less severe weaknesses may combine into an attack path that results in privileged access or the compromise of critical infrastructure.\n\nExposure management looks at those relationships. It asks whether an attacker can use the conditions present in the environment, what path they can take, and what impact they can achieve.\n\n**Validation provides the evidence.** By safely testing production environments from an attacker’s perspective, agencies can determine whether a weakness is actually exploitable, identify the attack path it enables, and understand the potential mission impact.\n\nThat evidence makes prioritization more useful. It complements CISA’s risk factors by showing how they translate into attacker opportunity within a particular agency.\n\n## Remediate the Attack Path, Not Just the Finding\n\nUnderstanding the attack path can also change the remediation decision.\n\nSuppose an attacker uses a weak credential to access a server, escalates privileges, extracts a privileged credential, and moves laterally to critical infrastructure. Changing the original credential may interrupt that specific route, but it does not necessarily address the broader exposure.\n\nThe agency may also need to prevent privilege escalation, protect credential material, restrict where administrative identities can authenticate, and limit lateral movement to critical systems.\n\nThe objective is not simply to close the first finding. It is to remove the conditions that allowed an attacker to turn that weakness into mission impact.\n\nThis context can also strengthen Plan of Action and Milestones decisions. Remediation owners, due dates, exceptions, compensating controls, and residual risk can be evaluated against a demonstrated attack path rather than an aging finding alone.\n\n## Verification Proves the Risk Was Reduced\n\nRemediation does not automatically mean the exposure is gone.\n\nA patch may not have reached every affected asset. A configuration change may not work as intended. A compensating control may block one technique while leaving another path to the same target. Closing a ticket proves that an action was taken, not that the original impact is no longer achievable.\n\nVerification closes that gap.\n\nAfter remediation, agencies should retest the exposure and attempt to reproduce the original attack path. This allows them to confirm that the weakness is no longer exploitable, the path to the affected assets has been broken, and another route does not still lead to the same impact.\n\nValidation proves what an attacker can do before remediation. Verification proves whether they can still do it afterward.\n\n## The Exploitation Evolution\n\nCISA is not telling agencies to stop managing vulnerabilities.\n\nIt is telling them to stop treating every vulnerability as though it presents the same level of risk.\n\nThat is an important step. The next is connecting CISA’s risk-based prioritization model with evidence from the environment itself.\n\nThe NodeZero® Proactive Security Platform adds environment-specific evidence to CISA’s risk factors by showing whether a weakness is exploitable, the attack path it enables, and whether remediation changed the outcome. It complements vulnerability scanners, asset inventories, threat intelligence, patch management, and established remediation processes by helping federal teams understand which exposures demand action.\n\nFederal agencies will never have unlimited time or resources to patch every vulnerability immediately. But they can make better decisions about what to fix first.\n\nIt’s time to stop patching blindly. Find the exposures attackers can use, understand where those exposures lead, and prove that the fixes changed the outcome.\n\nWhat does this shift mean for your agency’s next remediation decision? Join me and CISA’s Jahanzeb Khan on November 12 at 11 a.m. ET for **Racing the Exploit Clock: Vulnerability Management for the AI Era**. We’ll discuss how continuous validation helps agencies prioritize fixes, reassess accepted risks, and prove that exploitable paths to mission-critical systems have been reduced.", "url": "https://wpnews.pro/news/stop-patching-blindly-what-cisas-new-prioritization-approach-means-for-federal", "canonical_source": "https://horizon3.ai/intelligence/blogs/cisa-bod-26-04-stop-patching-blindly/", "published_at": "2026-11-10 13:15:00+00:00", "updated_at": "2026-11-10 13:22:39.713536+00:00", "lang": "en", "topics": ["ai-policy"], "entities": ["CISA", "Lindsey Cerkovnik", "Binding Operational Directive 26-04", "Known Exploited Vulnerabilities Catalog", "Common Vulnerability Scoring System", "ENISA", "EU Cyber Resilience Act"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/stop-patching-blindly-what-cisas-new-prioritization-approach-means-for-federal", "markdown": "https://wpnews.pro/news/stop-patching-blindly-what-cisas-new-prioritization-approach-means-for-federal.md", "text": "https://wpnews.pro/news/stop-patching-blindly-what-cisas-new-prioritization-approach-means-for-federal.txt", "jsonld": "https://wpnews.pro/news/stop-patching-blindly-what-cisas-new-prioritization-approach-means-for-federal.jsonld"}}