Bottom line: AI-driven attacks force organizations to fundamentally rethink vulnerability management: complete attack paths, not individual CVE vulnerabilities, must be prioritized on a risk basis.
CISA’s new directive BOD 26-04 introduces risk-based patch deadlines instead of uniform timelines. Artificial intelligence makes this approach a necessity, as attackers reduce the time from initial access to lateral movement to an average of 29 minutes.
CISA’s Binding Operational Directive 26-04 represents a paradigm shift in vulnerability management. Rather than patching all critical vulnerabilities on a uniform schedule, the directive prioritizes remediation based on risk: remediation timelines range from three days for the highest risks to deferring minimal risks. This marks the federal government’s departure from the pure severity approach, in which CVSS scores alone would determine whether a patch is urgent.
The approach is sound: CVSS ratings say little about whether a vulnerability is externally accessible, actively exploited, automatable, or gives the attacker control over the asset. Yet AI compresses the entire attack chain. CrowdStrike reports that the average time from compromise to lateral movement (eCrime breakout) has dropped to 29 minutes; the fastest observed breakout took 27 seconds. Mandiant documented that attackers transfer access between operators in a median of 22 seconds. In this context, the three days mandated by BOD do not seem aggressive, but rather luxurious.
AI itself becomes an attack surface. Organizations are rapidly deploying Copilots, browser agents, autonomous workflows, and other AI systems that come with prompts, plugins, connectors, and integrations that require protection. Attackers simultaneously leverage AI to automate their operations: reconnaissance, vulnerability research, exploit generation, phishing, credential harvesting, and even portions of lateral movement can be accelerated or orchestrated. Research demonstrates autonomous agents bearing much of the operational work in sophisticated cyberattacks while humans monitor strategic objectives. Campaigns become more easily scalable, targets can be pursued in parallel, and attackers can test many more paths into the network before defenders respond.
The classical approach of assessing CVEs individually is insufficient. Modern attacks follow paths, not individual findings. They combine vulnerabilities with stolen identities, cloud misconfigurations, exposed APIs, SaaS weaknesses, and increasingly AI systems into attack routes to critical assets. Vulnerability management teams, identity teams, cloud security, and application security work in isolation – but attackers do not recognize these boundaries. They exploit gaps between these responsibilities as stepping stones. BOD 26-04 is a step in the right direction, but AI demands more: not merely the acceleration of existing processes, but their fundamental redesign – with the goal of managing exposures holistically and contextually, rather than patching vulnerabilities in isolation.
Source: www.csoonline.com · Published 29 July 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.