Risk-based patching is the future. AI made it table stakes

CISA's new Binding Operational Directive (BOD) 26-04 shifts from patching all critical vulnerabilities on the same schedule to a risk-based approach, with patch deadlines ranging from three days for the highest-risk issues to deferral for lower-risk ones. However, AI is accelerating attacks so rapidly (attackers can establish footholds and move laterally in under an hour) that the three-day window for the riskiest vulnerabilities may not be aggressive enough, and organizations must rethink their vulnerability management processes beyond simply patching faster.