CISA Just Changed the Rules on Patching. Does Your Security Program Keep Up?

The directive requires federal agencies to patch their highest-risk vulnerabilities within **three calendar days** and, critically, to check whether a system was already compromised *before* applying the patch.

That last part is what most security teams miss. Patching doesn't evict an attacker who's already inside.

While BOD 26-04 applies directly to federal civilian agencies, it signals exactly where the regulatory bar is moving for regulated industries — and the four-variable risk model it introduces is the new standard every security program will be measured against.

What the Directive Actually Requires

CISA's new model scores every vulnerability across four variables:

1. Is the asset publicly exposed?
2. Is the vulnerability in the Known Exploited Vulnerabilities (KEV) catalog?
3. Can an adversary automate the exploit?
4. Does successful exploitation give an attacker full system control?

A vulnerability that checks all four boxes must be remediated in three days — with forensic triage conducted alongside patching to confirm whether the system is already compromised. The old CVSS-based approach, where everything got the same 15-day clock, is gone.

*Source: CISA Binding Operational Directive 26-04, June 10, 2026

What This Means If You're Not a Federal Agency

Ask your security team these four questions:

1. Do you know which of your assets are publicly exposed right now — not as of your last scan, but today?
2. Do you have a process for checking whether a vulnerable system is already compromised before you patch it?
3. If AI is shortening the window between vulnerability disclosure and active exploitation to hours — does your detection keep pace?
4. If a regulator or auditor applied this four-variable model to your environment tomorrow, how would you score?

The directive was shaped in part by CISA's concern that AI is compressing the time between patch release and weaponization. The window to act is getting shorter — not longer.

The Gap BOD 26-04 Exposes

Most organizations can patch. Fewer can answer the harder question first: are we already breached?

That's a detection and response problem, not a patching problem. Continuous monitoring, validated detection rules, and forensic triage capability are what separate organizations that can answer that question from those that can't.

Find out where you stand before a regulator or attacker does.

Schedule a 30-minute intro call with one of our experts to learn where your organization's risk stands.