Notifications
Clear all
Topic starter
01/08/2026 10:43 pm
TL;DR: CISA’s BOD 26-04 replaces severity-first remediation with a risk model that weighs public exposure, KEV status, attacker automation, and operational impact, with some critical fixes due in as little as three days, according to Tonic and CISA. Static vulnerability scoring is no longer enough when exploitability and response speed now drive real exposure reduction.
NHIMG editorial — based on content published by Tonic: CISA BOD 26-04 and the move from severity to exposure in vulnerability remediation
Questions worth separating out
A: Prioritise by combining exploitability, asset criticality, compensating controls, and process ownership.
Q: Why do ownership and asset tagging change remediation outcomes so much?
A: Because remediation speed depends on routing the issue to the right team immediately.
Q: What breaks when organisations still rely on severity-only vulnerability management?
A: They fix the wrong things first.
Practitioner guidance
- Replace CVSS-only prioritisation with exposure-based triage Score vulnerabilities using public exposure, KEV status, exploit automation, and operational impact, then route only the highest-risk items into immediate remediation queues.
- Map asset ownership before remediation deadlines start Require accurate ownership and tagging for internet-accessible systems so fixes can be assigned to the right control owner without delay.
- Feed identity context into vulnerability decisions Link privileged accounts, service identities, and external access paths to vulnerability records so remediation priority reflects blast radius, not just scanner output.
What's in the full article
Tonic's full article covers the operational detail this post intentionally leaves for the source:
- The directive's full four-factor prioritisation model for remediation decisions and how CISA expects agencies to apply it.
- The 60-day and 180-day operational deadlines, including how reporting, tagging, and process updates are expected to change.
- The agency-facing requirements for CDM reporting, Cyber Hygiene scanning, and continuous identification of internet-accessible assets.
- The implications for cloud and third-party environments where responsibility remains with the federal agency, not the hosting provider.
👉 Read Tonic's analysis of CISA BOD 26-04 and risk-based remediation →
CISA BOD 26-04: is your remediation model still CVSS-first?
Explore further
01/08/2026 10:52 pm
Severity-first vulnerability management is becoming an accountability failure, not just an efficiency problem. BOD 26-04 reflects a wider reality: defenders lose the advantage when they prioritise by score instead of reachability, exploitability, and business impact. That same failure mode appears in identity programmes when teams treat privileges, secrets, and service accounts as static inventory rather than live exposure. The practical conclusion is that remediation policy now has to track attack paths, not just ticket queues.
A question worth separating out:
Q: Who is accountable when a cloud vulnerability becomes a breach path?
A: Accountability sits across vulnerability management, cloud security, and identity governance because the breach path only exists when a flaw, exposure, and privilege combine. Teams that own only one layer cannot fully govern the risk. Frameworks like the NIST Cybersecurity Framework help assign governance across identify, protect, detect, respond, and recover.
👉 Read our full editorial: CISA BOD 26-04 shifts remediation from severity to exposure
