The Cybersecurity and Infrastructure Security Agency (CISA) issued a binding operational directive Wednesday compressing federal civilian agencies' patch timelines for critical vulnerabilities to 72 hours. The move responds to AI models that are simultaneously accelerating vulnerability discovery and lowering the barrier for mass exploitation.

CISA's acting executive assistant director for cybersecurity, Chris Butera, framed the directive as a prioritization framework rather than a blanket speed-up. Agencies must now evaluate each vulnerability against four criteria: public exposure of the affected system, inclusion in CISA's Known Exploited Vulnerabilities Catalog, whether exploitation can be fully automated, and the access level an attacker gains. A bug hitting all four marks triggers a three-day patch deadline plus a forensic triage to check for prior compromise.

This replaces CISA's 2019 and 2021 directives, which set 15-day and 30-day windows for critical and high-urgency flaws respectively. Even then, CISA noted that 42% of known exploited vulnerabilities saw active use within 24 hours of disclosure. The new rubric acknowledges that AI threat actors can now automate exploit chains end-to-end, making weeks-long patch cycles untenable.

Butera acknowledged the directive's limits: a 24-hour deadline was rejected as infeasible for most agencies given funding and staffing constraints. The approach is incremental, but Emily Long, CEO of cloud security firm Edera, argues patching alone is insufficient. "If your architecture doesn't limit blast radius after a breach, you're just running faster on the same treadmill," she said. "Containment by design needs equal priority."

CISA's directive is explicitly an initial response to AI-capable adversaries. The real engineering challenge—designing systems that invalidate entire vulnerability classes—remains on the table.

Source: Wired