The US Government Just Changed How Agencies Must Fix Security Flaws. It Is Not Enough.
A new federal directive finally ties patch deadlines to real-world risk. Then AI rewrote the problem.
Key points
- CISA's Binding Operational Directive 26-04, issued in 2025, sets patch deadlines as tight as three days for the highest-risk software flaws in federal systems.
- CrowdStrike found the average time for attackers to spread from one system to others inside a network has fallen to just 29 minutes, with the fastest case taking 27 seconds.
- The 2026 Verizon Data Breach Report found that 39% of attack chains involved stolen or abused identities, compared with 31% that started with a software vulnerability.
- CrowdStrike also recorded a 42% year-on-year rise in vulnerabilities exploited before the software maker had even announced them.
- Patching faster matters, but attackers increasingly combine flaws with stolen passwords and misconfigured cloud services, so no single fix closes every door.
The US Cybersecurity and Infrastructure Security Agency (CISA), the federal body responsible for protecting government computer systems, published a new rule this year called Binding Operational Directive 26-04. A Binding Operational Directive is an order that all civilian federal agencies must follow, no exceptions.
The rule changes how agencies handle software vulnerabilities, meaning flaws in software that attackers can use to break in. Rather than telling every agency to patch every serious flaw on the same fixed schedule, the directive sorts vulnerabilities by actual risk. The most dangerous ones must be fixed within three days. Lower-risk flaws can wait, or be deferred entirely.
That is a genuine step forward. For years, the blunt instrument was a single severity score, called a CVSS score, that ranked flaws from one to ten. The problem: a ten-out-of-ten flaw on an internal server nobody can reach from the internet is far less urgent than a six-out-of-ten flaw sitting on a public-facing login page. BOD 26-04 acknowledges that gap. It is overdue.
So why is three days not enough?
Because attackers no longer need days. CrowdStrike's research shows that once criminals get a foothold in a network, they move to other systems in a median of 29 minutes. Mandiant found that access handed between operators takes a median of 22 seconds. A three-day patching window, genuinely aggressive by government standards, is still measured in the wrong unit.
AI is the reason the clock sped up. Criminals now use AI tools to automate the early, labour-intensive stages of an attack: scanning for weak points, writing convincing phishing emails (fake messages designed to steal passwords), and testing ways into a system. Work that once required a team of specialists can now be largely orchestrated by software running around the clock.
How do modern attacks actually work?
They chain problems together. A single patched vulnerability rarely stops a determined attacker.
| Attack ingredient | What it is in plain English |
|---|---|
| Unpatched vulnerability | A known software flaw the victim has not yet fixed |
| Stolen credentials | A username and password bought on a criminal marketplace |
| Cloud misconfiguration | A setting that accidentally leaves data or systems open |
| Over-permissioned identity | An account with far more access rights than its job requires |
| Compromised AI agent | An automated AI tool that has been hijacked to act for the attacker |
The 2026 Verizon Data Breach Report, first highlighted in CSO Online's analysis of the directive, found that 39% of successful attack chains involved identity problems, such as stolen or misused account credentials. Only 31% began with a software vulnerability. Patching alone would not have stopped the majority.
An attacker who steals a low-level employee's password can find an account with too many permissions, hop across cloud systems, hit a vulnerable internal application, and reach sensitive business data. None of those individual problems looks catastrophic on its own. Together, they form a clear path.
What should organisations actually do?
Three things matter most right now.
First, maintain an accurate, live picture of everything connected to your network, including cloud services, third-party applications, and any AI tools staff are using. You cannot protect what you cannot see.
Second, test whether your defences actually work, not just whether they are switched on. Techniques called breach-and-attack simulation and automated penetration testing (both terms for controlled, safe attempts to break your own systems) answer the practical question: if an attacker tried this path today, would they succeed?
Third, treat identity with the same urgency as patching. Enforce strong authentication, meaning at least two forms of proof before anyone logs in, and regularly audit which accounts have access to what. Would MFA, short for multi-factor authentication, have helped in many of these cases? Honestly, yes, more often than almost any single patch.
The directive is a real improvement to federal security. Linking patch urgency to actual risk is the right direction. However, the threat has already moved past patching alone, and keeping up means rethinking the whole picture, not just fixing flaws faster.
Common questions
Does this rule affect private companies or just the US government?
BOD 26-04 is a legal obligation only for civilian US federal agencies. Private businesses and organisations in other countries are not required to follow it, though the risk-based approach it describes is considered good practice everywhere.
What is the single most effective thing an ordinary employee can do?
Use a unique, strong password for every work account and turn on multi-factor authentication, where logging in also requires a code sent to your phone or generated by an app. Stolen credentials are involved in the majority of breaches, and this one step removes much of their value to an attacker.
