Earlier this year, the U.S. government's Cybersecurity and Infrastructure Security Agency (CISA) fundamentally changed how civilian federal agencies are supposed to manage and mitigate software vulnerabilities.
Issued June 10, 2026, CISA's Binding Operational Directive (BOD) 26-04 replaces uniform patching schedules with dynamic, risk-based remediation deadlines. The change also has significant implications for federal contractors, critical-infrastructure operators and their technology suppliers.
Meeting these new expectations requires a shift to continuous vulnerability assessment, accurate exposure information and verifiable remediation.
"The challenge is what agency leaders can do now that this directive exists, especially given that the AI risk-generation machine keeps increasing the number of risks and shortening the time to act," writes RapidFort Public-Sector VP Berk Bucukoglu in a recent blog post.
Why CISA is changing the vulnerability-management model
Traditional vulnerability management, as practiced by federal agencies and most private firms, relies heavily on static severity scores, periodic scanning and fixed patching schedules. "Patch everything" is the general rule.
But not every vulnerability presents the same danger. A flaw in an internet-facing application may demand immediate attention, while an identical flaw in an isolated system poses substantially less risk. The former is clearly a higher priority than the latter.
Meanwhile, AI-assisted attackers are accelerating vulnerability discovery and exploitation, shrinking defenders' response windows and making intermittent patching schedules hopelessly obsolete.
"If the previous state of patching was not viable, AI only now widens it," observes Bucukoglu.
CISA's new approach recognizes that organizations cannot patch everything simultaneously but recommends that they patch continuously. Organizations must concentrate resources on vulnerabilities that attackers can realistically exploit.
Reactive patching alone is insufficient: Organizations must also proactively reduce their software attack surfaces by eliminating unnecessary components before vulnerabilities accumulate.
"That is not the tuning of a process," writes Bucukoglu. "It is the retirement of a failing doctrine and the creation of a more viable one."
What CISA BOD 26-04 mandates, and why requirements may be hard to meet
BOD 26-04 establishes five remediation tiers for vulnerabilities, based on four factors:
- Asset exposure: Whether the system affected by a vulnerability is publicly accessible.
- Known exploitation: Whether a given vulnerability appears in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- Exploit automation: Whether attackers can automate exploitation of a vulnerability.
- Technical impact: How much control successful exploitation of a vulnerability provides.
The highest-risk category requires remediation within three days and forensic triage for qualifying exploited vulnerabilities. Other findings receive longer deadlines, potentially extending to the next scheduled system upgrade.
The directive directly binds covered civilian federal agencies but not privately owned critical-infrastructure companies or suppliers. Nevertheless, contractors and infrastructure operators may encounter similar expectations through procurement requirements, contractual obligations and security programs, and CISA recommends that these organizations adopt BOD 26-04.
Compliance with the directive presents substantial operational challenges, however. Security staffers accustomed to intermittent rounds of patching everything must now continuously correlate vulnerability intelligence with actual deployment conditions, recalculate deadlines when risk changes, and document remediation progress.
"Teams are now expected to prove that remediation is happening on time against a risk-weighted CISA standard, not just show that scans were run and tickets were filed," notes RapidFort National Security Leader Austin Sedaghatpour in a blog post.
Obviously, static scans and manually updated spreadsheets cannot easily maintain the required level visibility across thousands of changing workloads. Many federal agencies will need to implement automated tools to meet the new standards.
How Continuous Compliance helps agencies and affected companies comply
RapidFort's Continuous Compliance capability, available for critical-infrastructure and "federal-adjacent" organizations, translates CISA's risk model into operational workflows for containerized software. The platform refreshes CISA KEV and Vulnrichment information every 15 minutes, recalculating remediation tiers and deadlines as threat intelligence or exposure conditions change.
Rather than relying exclusively on static container-image scans, RapidFort examines running workloads and can distinguish internet-facing deployments from internal instances of identical software. Its dashboards identify affected assets, remediation deadlines and whether findings are on track, overdue or require triage.
RapidFort also supports Jira-based investigation workflows and CSV exports for reporting and audit evidence. Crucially, its broader platform can harden container images, apply upstream fixes and remove unused vulnerable components, reducing the number of findings that require remediation.
CISA BOD 26-04 shifts vulnerability management from counting patches to demonstrating measurable risk reduction. By combining continuously updated risk intelligence, runtime context, remediation tracking and software hardening, RapidFort can assist organizations in operationalizing CISA-aligned practices while reducing their underlying attack surfaces.
"The directive does not just demand faster patching; it demands better prioritization, clearer accountability, and auditable evidence that high-consequence vulnerabilities are being addressed according to risk," writes Sedaghatpour.
"For critical infrastructure and federal supply chain organizations, that standard is quickly becoming a de facto expectation, whether or not the directive applies to them directly."
