CISA is rethinking how it prioritizes risks and vulnerabilities for feds, private sector

CISA acting director Nick Andersen outlined a new binding operational directive to shift vulnerability management away from blanket patching toward risk-based prioritization—focusing on asset criticality, internet exposure, KEV alignment and exploitability—while noting AI-driven threat dynamics, planned hiring to bolster operational capabilities, and ongoing work to implement CIRCIA reporting requirements.