CISA: Most Breaches Still Start With Old, Unpatched Bugs
A new review from the US cyber agency finds attackers rarely need clever tricks. They scan for known, exposed flaws that companies never got around to fixing.
Key points
- The US Cybersecurity and Infrastructure Security Agency (CISA) published its Vulnerability Review covering fiscal years 2024 and 2025.
- Most break-ins studied relied on well-known software flaws that were already public, not on custom hacking tools.
- CISA is pushing a framework called Binding Operational Directive 26-04 that ranks flaws by four risk factors, including whether attackers are already using them.
- The review sets a baseline before AI-assisted bug hunting starts to change how quickly new flaws surface.
- CISA wants software makers to fix whole classes of weaknesses at the source under its Secure by Design push.
Most hacks are boring. That is the quiet message running through a new CISA Vulnerability Review that looks at how organisations were actually broken into during the last two US government budget years.
The review, published by CISA Cybersecurity Advisories, says attackers are mostly not using exotic tools or secret zero-days, meaning software flaws the maker did not know about. They are scanning the open internet for machines running old software with public, already-patched holes, and walking in.
In plain terms: the front door was left unlocked, and someone tried every door on the street until one opened.
Why does this matter to ordinary people?
Because the services you use every day, your bank, your doctor's office, your local council, run on the same kinds of software that CISA is describing. When those systems get broken into, your data goes with them. The report's point is that most of these incidents were preventable with basic housekeeping.
CISA frames the problem as one of "systemic" weakness. Rather than chasing every new bug after it appears, the agency wants software makers to stop shipping the same classes of flaw in the first place. That is the heart of its Secure by Design campaign, which asks vendors to build safety in from the start rather than bolt it on later.
How should companies decide what to fix first?
CISA's answer is a new government-wide rulebook called Binding Operational Directive 26-04, which tells US federal agencies to rank flaws by risk instead of treating every alert equally. Private companies are being encouraged to follow the same logic.
The directive weighs four things:
| Factor | What it means in plain English |
|---|---|
| Exposure status | Is the vulnerable system reachable from the internet? |
| KEV Catalog status | Is the flaw already on CISA's Known Exploited Vulnerabilities list, meaning attackers are actively using it? |
| Automated exploitation | Can criminals attack it at scale with a script? |
| Technical impact | If they succeed, how bad is the damage? |
A bug that scores badly on all four is the kind that should be patched this week, not next quarter. A bug buried on an internal server with no known exploit can wait its turn.
What is changing with AI?
CISA is clear that it wanted to publish this review now, before AI-assisted vulnerability discovery becomes routine. Tools that can read source code and spot flaws automatically are getting better fast, on both sides. Defenders will find more bugs earlier. So will attackers.
The baseline matters because it lets the agency measure, a year or two from now, whether the flood of AI-found bugs actually changed the shape of real-world attacks, or whether criminals kept doing what they always do: scanning for the easy ones.
What can readers take from this?
If you run a small business, the practical read is short. Keep software updated. Turn on automatic patching where you can. Ask your IT provider whether any of your internet-facing systems appear on CISA's Known Exploited Vulnerabilities list, and if so, when they will be fixed.
The attackers are not being clever. That is the good news, and the bad news.
