CISA directive revamps how agencies prioritize vulnerable systems

The Cybersecurity and Infrastructure Security Agency issued a binding directive requiring federal agencies to prioritize patching based on risk — assigning remediation windows from three days to 60 days depending on exposure, exploitation, automation potential, and impact — while encouraging partners to adopt similar measures and noting AI-driven capabilities increase the urgency of focused vulnerability management.