CISA: Most Breaches Still Start With Old, Unpatched Bugs
A new review from the US cyber agency finds attackers rarely need clever tricks. They scan for known, exposed flaws that companies never got around to fixing.
Key points - The US Cybersecurity and Infrastructure Security Agency (CISA) published its Vulnerability Review covering fiscal years 2024 and 2025. - Most break-ins studied relied on well-known software flaws that were already public, not on custom hacking tools. - CISA is pushing a framework called Binding Operational Directive 26-04 that ranks flaws by four risk factors, including whether attackers are already using them. - The review sets a baseline before AI-assisted bug hunting changes how quickly new flaws surface. - CISA wants software makers to fix whole classes of weaknesses at the source under its Secure by Design push.
Most hacks are boring. That's the quiet message running through a new CISA Vulnerability Review that looks at how organisations were actually broken into during the last two US government budget years.
The review, published by CISA Cybersecurity Advisories, says attackers aren't using exotic tools or secret zero-days, meaning software flaws the maker didn't know about. They're scanning the open internet for machines running old software with public holes that have had patches sitting unused, and walking in.
The front door was left unlocked. Someone tried every door on the street until one opened.
Why does this matter to ordinary people?
The services you use every day, your bank, your doctor's office, your local council, run on the same kinds of software CISA is describing. When those systems get broken into, your data goes with them. Most of these incidents were preventable with basic housekeeping.
CISA frames the problem as systemic. Rather than chasing every new bug after it appears, the agency wants software makers to stop shipping the same classes of flaw in the first place. That's the heart of its Secure by Design campaign, which asks vendors to build safety in from the start. We first covered that push on 28 May 2026, and it's generated three further stories from Threat Vectr in the last 90 days.
How should companies decide what to fix first?
Private companies are being encouraged to follow the same logic.
The directive weighs four things:
| Factor | What it means in plain English |
|---|---|
| Exposure status | Is the vulnerable system reachable from the internet? |
| KEV Catalog status | Is the flaw already on CISA's Known Exploited Vulnerabilities list, meaning attackers are actively using it? |
| Automated exploitation | Can criminals attack it at scale with a script? |
| Technical impact | If they succeed, how bad is the damage? |
A bug that scores badly on all four should be patched this week, not next quarter. A bug buried on an internal server with no known exploit can wait its turn.
What is changing with AI?
CISA wanted to publish this review before AI-assisted vulnerability discovery becomes routine. Tools that read source code and spot flaws automatically are getting better fast, on both sides. Defenders will find more bugs earlier. So will attackers. Our August story on the NVD's 72% surge in reported flaws showed how strained the infrastructure for tracking all this already is.
The baseline lets the agency measure, a year or two from now, whether AI-found bugs actually changed the shape of real-world attacks, or whether criminals kept doing what they always do: scanning for the easy ones.
What can readers take from this?
If you run a small business, keep software updated. Turn on automatic patching where you can. Ask your IT provider whether any internet-facing systems appear on CISA's Known Exploited Vulnerabilities list, and if so, when they'll be fixed.
Attackers aren't being clever. That's the good news, and the bad news.
