CISA orders federal agencies to “patch smarter”

CISA’s new Binding Operational Directive BOD 26-04 establishes a risk-based vulnerability management framework for U.S. federal civilian agencies, prioritizing remediation of internet-facing, actively exploited, and high-impact flaws with mandated timelines; the report also highlights the directive’s perimeter focus (less emphasis on internal compromises and LOTL techniques) and recommends using additional signals like EPSS and LEV to inform patching urgency.