CISA Tells US Agencies to Fix Security Bugs in as Little as 3 Days Thanks to AI Threats

**Executive summary:** The Cybersecurity and Infrastructure Security Agency (CISA) issued a binding operational directive requiring federal civilian agencies to prioritize and accelerate software patching based on a four-factor urgency assessment; vulnerabilities that are publicly exposed, listed in CISA's Known Exploited Vulnerabilities Catalog, automatable for exploitation, and provide significant access must be remediated within three days and undergo forensic triage. The directive updates prior 2019/2021 guidance in response to concerns that AI advances are speeding discovery and exploitation of vulnerabilities while balancing feasibility for agencies.