New CISA directive would reshape how agencies prioritize cyber risk, official says

CISA plans to issue a binding directive requiring federal agencies to prioritize remediation of vulnerabilities based on risk rather than attempting to address every known flaw; the agency emphasized limited resources, the need to make hard prioritization choices, and noted that AI-driven capabilities are accelerating the pace at which vulnerabilities can be weaponized.