Belgium
Denmark
Finland
Germany
Malaysia
Netherlands
Norway
Poland
Sweden
UK
Severity no longer decides what gets patched first. That's the message behind a small but telling change from the US Cybersecurity and Infrastructure Security Agency (CISA). On September 28, CISA retires its weekly Vulnerability Bulletin, a summary of new vulnerabilities organized by CVSS score. The reason: the agency is moving to risk-based vulnerability management, where real-world exploitation and exposure matter more than a severity number.
If you relied on the bulletin, CISA recommends subscribing to its Known Exploited Vulnerabilities (KEV) Catalog and Cybersecurity Advisories instead.
What is CISA BOD 26-04?
BOD 26-04 is a Binding Operational Directive, issued by CISA in June 2026, that requires US federal civilian agencies to prioritize security updates based on real-world risk rather than severity scores alone. Retiring the bulletin is CISA bringing its own communications in line with that directive.
The directive asks four questions about each vulnerability:
- Does it affect a publicly exposed asset?
- Is it known to be exploited?
- Can exploitation be automated?
- How much control would an attacker gain?
A vulnerability that meets all four criteria must be fixed within three days. Lower-risk vulnerabilities get more time.
BOD 26-04 also replaces two earlier directives, and with them the requirement for federal agencies to use CVSS for prioritization. For an agency whose earlier directives tied remediation deadlines to CVSS severity, that's a notable step.
Why severity-first vulnerability management stopped working
CVSS is still useful, as it measures how severe a vulnerability is on a technical level. The problem starts when teams treat that score as a to-do list. Three trends have made that approach unsustainable:
- Volume
AI is surfacing vulnerabilities faster than ever. In September, Microsoft fixed a record 974 vulnerabilities in a single Patch Tuesday from its use of AI tools to find vulnerabilities. Of those, only two were already being exploited, and one of them was rated High - not Critical. A team working by severity alone could fix more than a hundred critical vulnerabilities before reaching the one attackers were already using. The real challenge is finding those two - fast. - Speed
The gap between disclosure and exploitation keeps shrinking, as we covered in our look at Claude Mythos. When cybercriminals can weaponize a vulnerability in days, working through a backlog in severity order leaves the most dangerous ones waiting too long. - Blind spots
Many vulnerabilities were rated Low because they were hard to exploit, not because they were harmless. As we explained in a recent article, AI removes much of that difficulty.
What is risk-based vulnerability management?
Risk-based vulnerability management is an approach that prioritizes vulnerabilities by the real risk they pose to your organization, not by severity score alone. It combines three kinds of context:
- Exploitation: Is the vulnerability being exploited in the wild, or likely to be?
- Exposure: Can an attacker reach the affected asset, for example because it's internet-facing?
- Impact: How important is the asset, and what would a compromise cost the business?
Exploitation data comes in two forms. Confirmed exploitation, like the entries in CISA KEV, shows what's already under attack. Predictive signals like the Exploit Prediction Scoring System (EPSS) estimate how likely a vulnerability is to be exploited in the coming weeks. That's why a medium-severity vulnerability with a high likelihood of exploitation can deserve attention before a critical one that no one is actively targeting.
Read more about the threat intelligence signals we use to prioritize vulnerabilities.
This is also where risk-based vulnerability management meets exposure management: the broader practice of identifying everything that makes you reachable, including misconfigurations and unknown assets that never get a CVE at all.
How to prioritize vulnerabilities when you can't patch everything
Vulnerability prioritization doesn't require a major overhaul. It starts with asking better questions of the process you already have.
-
Do you know which assets are internet-facing?
Exposure is one of the strongest risk signals, and you can't assess assets you don't know you have. -
Does your backlog reflect exploitation, or only severity?
If a medium-severity vulnerability appears in CISA KEV tomorrow, it should jump the queue. -
Have you defined which assets are business critical?
The same vulnerability on a payment server and on a test machine is not the same risk. -
How fast can you act on the vulnerabilities at top of the list?
Prioritization only pays off if the most urgent fixes happen in days, not in the next patch cycle. -
Are you assessing continuously?
A quarterly assessment can't keep pace with exploitation that moves in days.
If most of your answers are "not yet," start with the first question. Visibility comes before prioritization.
Why European security teams should take note
The BOD 26-04 only binds US federal agencies, so it's easy to dismiss as a US policy change, but that would be a mistake. CISA is one of the world's most influential cybersecurity authorities. It runs the KEV catalog that security teams everywhere rely on, and alongside MITRE, it sits at the top of the global CVE program. When CISA changes how it prioritizes vulnerabilities, it signals where the entire field is heading.
CISA isn't alone, either. The NIS2 Directive requires a systematic, risk-based approach to cybersecurity, including how vulnerabilities are handled. On both sides of the Atlantic, the message is now the same: prioritize by real risk, and keep doing it continuously.
For many organizations, that means rethinking the rhythm of their security work. A penetration test twice a year still has value, but it's a snapshot, and vulnerabilities are now disclosed and exploited in days. Taking risk-based vulnerability management seriously means knowing your exposure at all times and acting on the risks that matter as they appear, not waiting for the next scheduled test.
How we approach it at Holm Security
Risk-based prioritization has been central to our platform from the start, and it's only as good as the intelligence behind it. That's why we don't rely on a single source.
Our threat intelligence correlates official feeds like NVD and vendor advisories with confirmed exploitation data from two Known Exploited Vulnerabilities lists: CISA's and the one maintained by ENISA in the European Union Vulnerability Database (EUVD). The EUVD and its KEV list are built into every assessment automatically, which matters for European organizations. ENISA is the agency that receives your reports under NIS2 and the Cyber Resilience Act, so when it flags a vulnerability as actively exploited, regulators are already paying attention.
We also add exploit data, EPSS scores and intelligence on CVEs linked to ransomware campaigns. Each asset's risk score weighs known exploits and ransomware links heavily, gives extra weight to internet-facing assets and servers, and reflects the business impact you define.
Drawing on multiple sources also keeps prioritization steady when any one of them changes. CISA retiring its bulletin is a small example. A bigger one came in April 2025, when the contract behind the CVE program briefly lapsed. An intelligence stack that doesn't depend on a single feed keeps working.
The result is a list ranked by real risk, grounded in both US and European intelligence, so your team knows exactly where to start.
Wondering how your environment looks when it's ranked by real-world risk? Let's talk.
FAQ
-
What is CISA BOD 26-04?
BOD 26-04 is a June 2026 directive from CISA that requires US federal civilian agencies to prioritize security updates based on real-world risk. Vulnerabilities on exposed assets that are known to be exploited, automatable and high impact must be fixed within three days.
-
What is risk-based vulnerability management?
Risk-based vulnerability management prioritizes vulnerabilities by the real risk they pose, combining exploitation data, asset exposure and business impact. Unlike severity-based approaches, it focuses remediation on the vulnerabilities most likely to be used in an attack.
-
What is vulnerability prioritization?
Vulnerability prioritization is the process of deciding which vulnerabilities to fix first. Effective prioritization looks beyond CVSS scores to factors like known exploitation, internet exposure and asset criticality.
-
How should I prioritize vulnerabilities?
Start with exposure, exploitation and impact. Check whether the asset is internet-facing, whether the vulnerability is known to be exploited or has a high likelihood of exploitation, and how critical the asset is to the business. A vulnerability that meets several of these should move to the top of the queue, regardless of its CVSS score.
-
Does BOD 26-04 apply to European organizations?
No. BOD 26-04 only applies to US federal civilian agencies. But CISA is one of the world's leading cybersecurity authorities, so its move to risk-based vulnerability management is a strong signal for European organizations too, especially alongside NIS2's requirement for a risk-based approach.
Content Marketing Manager
With a decade of international experience, Anna's strength lies in bridging the gap between the creative and the technical with strategy in mind. With previous experience in tech scale-ups and cybersecurity, such as at Wealth-X and BlueVoyant, Anna breaks down what you need to know so you spend less time reading between the lines.
