CISA Vulnerability Review
CISA's Vulnerability Review finds most compromises exploit exposed, well-known flaws due to basic security failures, based on FY2024-2025 data.
The CISA Vulnerability Review analyzes CISA and open-source data from fiscal years 2024 and 2025. It concludes most compromises do not rely on advanced techniques; threat actors scan the internet for exposed, well-known software vulnerabilities. CISA urges organizations to address underlying weaknesses and prioritize vulnerabilities for remediation based on the risk they pose.
- Most compromises exploit known, exposed vulnerabilities
- Based on FY2024 and FY2025 CISA and open-source data
- CISA recommends risk-based vulnerability prioritization
Most compromises do not rely on advanced techniques or cutting-edge tools. Cyber threat actors scan the internet looking for exposed, well-known software vulnerabilities to exploit. Basic security failures enable most compromises and organizations can reduce their risk by addressing these underlying weaknesses and prioritizing vulnerabilities for action based on the risk they pose. The CISA Vulnerability Review provides organizations with critical insights into the root causes of insecure software and practical steps they can take to address these flaws to prevent exploitation. Analyzing CISA and open source data from fiscal years 2024 and 2025, the review establishes a baseline of today’s…
This source does not provide full text. Read it at cisa.gov.