Topic starter
18/08/2026 2:32 pm
TL;DR: CISA BOD 26-04 replaces CVSS-only patch queues with a four-variable risk model that combines asset exposure, KEV status, exploit automation, and technical impact, according to ArmorCode’s analysis. The shift matters because it makes remediation a continuous control problem, not a periodic ticketing exercise, and raises the bar for evidence, automation, and defensible prioritisation.
Editorial analysis by NHI Mgmt Group, based on content published by ArmorCode: “CISA BOD 26-04 Is an Architecture Mandate, Not a Patching Directive”.
By the numbers:
- CISA cited Verizon DBIR figures showing only 26% of KEV vulnerabilities were fully remediated in 2025.
Key questions
Q: What breaks when vulnerability management is based only on CVSS scores?
A: CVSS-only prioritisation breaks when several lower-scoring flaws can be combined into a complete exploit path.
Q: Why does asset exposure change the remediation decision more than patch timing alone?
A: Asset exposure determines whether a vulnerability is reachable in the first place, which is often the difference between routine backlog and active attack path.
Q: What are the signs that a vulnerability prioritization model is failing?
A: The clearest signs are long delays on known exploited vulnerabilities, tickets that lack ownership, duplicate findings across tools, and high-severity work that never maps to real attack paths.
Practitioner guidance
- Build live exposure mapping for remediation Correlate internet reachability, ownership, and business context to each asset so tiering reflects current exposure rather than static inventory.
- Tie vulnerability triage to evidence chains Record the four decision inputs for each high-risk finding, including the point in time and the asset instance that justified the tier.
- Automate 72-hour forensic triage workflows Route top-tier findings into a repeatable investigation process that confirms whether compromise existed before or after remediation.
Bottom line: CISA BOD 26-04 turns vulnerability management into an evidence-backed governance problem instead of a static patch queue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:19 pm
Risk architecture, not vulnerability queues, is now the governing model. BOD 26-04 makes the central point that severity is an input, not a decision. That changes the control objective from clearing tickets to maintaining a defensible, evidence-backed prioritisation system across assets, exploitability, and business impact. Practitioner implication: if prioritisation cannot be traced to live asset context, it is not yet a governance control.
A few things that frame the scale:
- The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should security and governance teams document remediation decisions for auditors and regulators?
A: Teams should log the asset instance, the four prioritisation inputs, the decision date, and the evidence used to justify the tier. That record needs to show why the finding was urgent, who accepted the risk if it was deferred, and how the organisation verified closure. Without that lineage, the programme cannot defend its prioritisation choices.
👉 Read our full editorial: CISA BOD 26-04 turns vulnerability management into risk architecture