CISA’s BOD 26-04 and the Shift Toward Risk-Based Patching
Over the last two years or so, vulnerability management has gradually shifted away from relying purely on CVSS scores.
First, many teams started adding EPSS to estimate how likely a vulnerability is to be exploited. Then the CISA Known Exploited Vulnerabilities (KEV) catalog became an important signal for deciding which vulnerabilities deserved immediate attention. Slowly, the industry moved toward a more realistic view of cyber risk.
Now, CISA’s new BOD 26-04 introduces a more systematic way of looking at vulnerability prioritization.
And honestly, it is a welcome development.
Moving Beyond CVSS Alone
For years, many organizations treated vulnerability management as a race to patch the highest CVSS scores first. The problem is that a high score does not always mean a vulnerability represents the highest operational risk.
Some vulnerabilities may have a high technical severity but are not exposed to the internet, are difficult to exploit, or are not actively targeted by attackers. Meanwhile, other vulnerabilities with lower scores may already be exploited in the wild and provide attackers with direct access to exposed systems.
BOD 26-04 acknowledges this reality by looking at several factors together: public exposure, KEV status, technical impact, and whether exploitation can be automated.
That is a far more practical model for modern vulnerability management.
A Different Way of Looking at Risk
Instead of asking only “How severe is this vulnerability?”, the new model asks additional questions:
- Is the system publicly exposed?
- Is the vulnerability actively exploited?
- Can exploitation be automated?
- Would exploitation provide total or partial control?
Depending on the answers, remediation timelines range from three days plus forensic triage to simply fixing vulnerabilities during the normal upgrade cycle.
| Publicly Exposed | KEV | Automatable | Impact | Timeline |
|---|---|---|---|---|
| Yes | Yes | Yes | Total | 3 days + triage |
| Yes | No | Yes | Partial | 14 days |
| No | Yes | No | Total | 14 days |
| No | No | No | Partial | Fix on upgrade |
This feels significantly closer to how mature security teams already think about cyber risk in practice.
A Practical Direction for Vulnerability Management
One aspect we particularly approve of is the remediation timeline model introduced in the directive. Combining exposure, exploitability, automation potential, and technical impact creates a far more realistic way to determine urgency.
Instead of treating all vulnerabilities equally, the framework focuses attention on the vulnerabilities attackers are most likely to exploit successfully in real-world environments.
That feels far more sustainable than endlessly chasing raw CVSS numbers alone.
How BaseFortify Fits In
At BaseFortify, we see this as further confirmation that vulnerability management is increasingly about context and prioritization.
Signals such as CVSS, EPSS, KEV status, and whether a system is publicly exposed help create a clearer picture of actual operational risk.
CISA’s BOD 26-04 may target a specific audience, but the broader message applies everywhere: effective vulnerability management is no longer just about patch volume.
It is about prioritizing what matters most first.
