The US Government Just Changed How Agencies Must Fix Security Flaws. It Is Not Enough.

Key points

• CISA's Binding Operational Directive 26-04, issued in 2025, sets patch deadlines as tight as three days for the highest-risk software flaws in federal systems.
• CrowdStrike found the average time for attackers to spread from one system to others inside a network has fallen to just 29 minutes, with the fastest case taking 27 seconds.
• The 2026 Verizon Data Breach Report found that 39% of attack chains involved stolen or abused identities, compared with 31% that started with a software vulnerability.
• CrowdStrike also recorded a 42% year-on-year rise in vulnerabilities exploited before the software maker had even announced them.
• Patching faster matters, but attackers increasingly combine flaws with stolen credentials and misconfigured cloud services, so no single fix closes every door.

The US Cybersecurity and Infrastructure Security Agency (CISA), the federal body responsible for protecting government computer systems, published a new rule this year called Binding Operational Directive 26-04. A Binding Operational Directive is an order that all civilian federal agencies must follow, no exceptions.

The rule changes how agencies handle software vulnerabilities, meaning flaws in software that attackers can use to break in. Rather than telling every agency to patch every serious flaw on the same fixed schedule, the directive sorts vulnerabilities by actual risk. The most dangerous ones must be fixed within three days. Lower-risk flaws can wait, or be deferred entirely.

That's a genuine step forward. For years, the blunt instrument was a single severity score, called a CVSS score, that ranked flaws from one to ten. A ten-out-of-ten flaw on an internal server nobody can reach from the internet is far less urgent than a six-out-of-ten flaw sitting on a public-facing login page. BOD 26-04 acknowledges that gap. It's overdue.

So why is three days not enough?

Because attackers no longer need days. CrowdStrike's data shows that once criminals get a foothold in a network, they move to other systems in a median of 29 minutes, with the fastest observed case taking just 27 seconds. Mandiant found that access handed between operators takes a median of 22 seconds. A three-day patching window, genuinely aggressive by government standards, is still measured in the wrong unit.

On 23 July we reported on exactly this pressure from the private sector: Microsoft was already pushing IT teams toward 72-hour patch cycles, citing AI tools that find and exploit flaws faster than defenders can respond.

AI is the reason the clock sped up. Criminals now use AI tools to automate the early, labour-intensive stages of an attack: scanning for weak points, writing convincing phishing emails (fake messages designed to steal passwords), testing ways into a system. Work that once required a team of specialists can now be largely orchestrated by software running around the clock.

How do modern attacks actually work?

They chain problems together. A single patched vulnerability rarely stops a determined attacker.

The 2026 Verizon Data Breach Report found that 39% of successful attack chains involved identity problems such as stolen or misused account credentials, while only 31% began with a software vulnerability. Patching alone wouldn't have stopped the majority.

An attacker who steals a low-level employee's password can find an over-permissioned account, hop across cloud systems, hit a vulnerable internal application, and reach sensitive business data. None of those individual problems looks catastrophic on its own. Together, they form a clear path.

What should organisations actually do?

Two priorities stand out above the rest.

First, maintain an accurate, live picture of everything connected to your network, covering cloud services and any AI tools staff are using. You can't protect what you can't see, and as we noted in our 27 July report on AI system defences, the attack surface expands every time an organisation deploys a new AI workflow without mapping it.

Second, treat identity with the same urgency as patching. Enforce strong authentication, meaning at least two forms of proof before anyone logs in, and regularly audit which accounts have access to what. Stolen credentials are involved in the majority of breaches. As our explainer on multi-factor authentication sets out, that one control removes much of the value of stolen passwords before any vulnerability even enters the picture.

The directive is a real improvement. Linking patch urgency to actual risk is the right direction. The threat has already moved past patching alone, though, and keeping up means rethinking the whole picture rather than just fixing flaws faster.

Common questions

Does this rule affect private companies or just the US government?

BOD 26-04 is a legal obligation only for civilian US federal agencies. Private businesses and organisations in other countries aren't required to follow it, though the risk-based approach it describes is considered good practice everywhere.

What is the single most effective thing an ordinary employee can do?

Use a unique, strong password for every work account and turn on multi-factor authentication, where logging in also requires a code sent to your phone or generated by an app. Stolen credentials are involved in the majority of breaches, and this one step removes much of their value to an attacker.