CISA BOD 26-04 tells agencies to prioritize patches by risk
Original title: Stop Patching Blindly: What CISA’s New Prioritization Approach Means for Federal Agencies
Timelines depend on internet access, known exploitation, whether exploitation can be automated, and attacker control.
Horizon3.ai explains CISA Binding Operational Directive 26-04, which tells federal civilian agencies to prioritize security updates using risk factors rather than CVSS alone. CISA ended its weekly vulnerability bulletins on September 28, 2026, and says volume plus AI-accelerated discovery means agencies cannot patch everything at once. The piece argues agencies still need internal evidence of exposure and attack paths, and it promotes exposure validation. It does not disclose a new vulnerability or confirmed exploitation.
Unconfirmed: The article does not state new exploitation; the attack-path example is hypothetical.
- CISA’s four factors are internet accessibility, active exploitation, automation, and level of control.
- The article says CVSS does not show reachability, compensating controls, or post-access impact.
- It cites the EU Cyber Resilience Act and ENISA reporting as a related disclosure example.
- The piece is vendor commentary and cuts off during a hypothetical remediation example.
- 1.Federal civilian agencies should apply BOD 26-04 risk factors when setting remediation timelines.
- Vendors
- Horizon3.ai
- Countries
- United States
From the original article
6 min read at horizon3.ai
CISA's BOD 26-04 moves federal agencies from severity-based patching to risk-based prioritization. Here's how validation and verification show which exposures to fix first and prove the fixes worked.
By Tim Jones · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.