The Vulnerability Window Is Closing Quickly: What CISA and Five Eyes Now Say About Public Sector Security

Two significant developments emerged recently that I think every public sector security leader should pay attention to. First, the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04, which fundamentally changes how federal civilian agencies must prioritize vulnerability remediation. Second, the Five Eyes cybersecurity agencies issued a joint statement warning that AI is compressing the timeline between vulnerability discovery and exploitation. The change is significant enough to demand an urgent rethink of how organizations manage risk. These two documents send a clear message: The old ways of patching on a fixed schedule are no longer adequate.

While BOD 26-04 is binding only on federal civilian agencies, the reasoning behind it belongs to the entire public sector. State, local, tribal, and territorial governments, education systems, and the critical infrastructure that citizens depend on every day are facing the same compressed timelines. They often do so with leaner teams and tighter budgets than their federal counterparts.

CISA BOD 26-04: Risk-based vulnerability prioritization

For years, federal vulnerability management has operated on relatively simple timelines: Agencies patch known exploited vulnerabilities (KEV) within a set number of days, regardless of context. BOD 26-04 replaces that one-size-fits-all model with a risk-tiered framework built around four concrete factors:

• Whether the vulnerable asset is publicly exposed
• Whether the vulnerability is in the KEV catalog
• Whether it can be automatically exploited
• Whether the adversary gains extensive control post-exploitation

A vulnerability that scores high on all four factors must be remediated within 3 days. An example would be a publicly exposed system with an automatically exploitable flaw in the KEV catalog that gives an attacker full control. On top of this, agencies are required to perform forensic triage to determine whether exploitation has already occurred. Less severe combinations allow for longer remediation windows. The key shift is that agencies must now actively account for the risk in their reasoning rather than just run down a checklist.

For public sector teams beyond the federal civilian agencies it directly covers, this framework is worth internalizing. State and local governments rarely operate under the same mandates, but they defend the same kinds of internet-exposed systems and face the same malicious actors. The framework reflects how mature organizations are increasingly approaching vulnerability management: not as a compliance exercise, but as a continuous, context-aware risk reduction process.

Five Eyes: AI is shrinking the exploitation window

If BOD 26-04 tells us how to prioritize, the Five Eyes statement tells us why urgency matters now more than ever. The joint statement from cybersecurity agencies of the U.S., UK, Australia, Canada, and New Zealand is direct: Frontier AI models are anticipated to fundamentally transform offensive cyber capabilities. The timeline has narrowed from years to months.

In practical terms, malicious actors are increasingly able to use AI to automate reconnaissance and accelerate vulnerability research. This compresses the time between when a flaw is discovered and when it gets weaponized at scale. Therefore, the window for organizations to patch before exploitation occurs is getting smaller. The Five Eyes agencies specifically called out the need to accelerate patching processes, reduce the attack surface, and integrate AI into defensive security operations to keep pace.

This aligns closely with what we are seeing in our own threat intelligence research at TrendAI™. AI is not just a tool for defenders; it is being actively incorporated into offensive tooling by nation-state actors and cybercriminal groups alike. Government agencies at every level, critical infrastructure operators, and the public services that citizens rely on are squarely in the crosshairs.

What this means going forward

BOD 26-04 and the Five Eyes statement are not just policy documents. They are signals from the highest levels of the global cybersecurity community that the vulnerability management paradigm is changing. Organizations that are still operating on fixed-schedule patching without continuous risk context are already behind the curve, and the AI-driven acceleration of exploitation timelines means that gap will only grow.

My advice to public sector leaders is to take both documents seriously. Whether you are a federal civilian agency bound by the directive or a state, local, or tribal government that is not, these two documents are worth your consideration. Use the BOD 26-04 risk framework as a template for your own vulnerability prioritization policy. Take the Five Eyes warning about AI-enabled attacks at face value and pressure-test your detection and response timelines accordingly. And make sure you have the vulnerability intelligence infrastructure in place to support risk-based decision-making at speed.

The window between discovery and exploitation is closing. The organizations that will fare best are the ones that shrink their response time faster than malicious actors can automate theirs.

How TrendAI Vision One™ and TrendAI™ ZDI help organizations respond

So, how do organizations close this gap? Both directives point to what many public sector organizations are missing: the ability to continuously assess vulnerability risk in context, prioritize intelligently, and act fast. They often must do this with limited staff and resources. This is precisely where TrendAI Vision One™ Cyber Risk Exposure Management (CREM), backed by vulnerability intelligence from the TrendAI™ Zero Day Initiative™ (ZDI), comes in.

TrendAI™ ZDI is the world's largest vendor-agnostic bug bounty program, and its intelligence feeds directly into CREM. That means organizations using TrendAI Vision One™ CREM benefit from early visibility into vulnerabilities, often before patches are publicly available. They also get the context they need to assess whether a specific flaw is being actively researched or exploited in the wild. This is exactly the kind of intelligence that makes the risk-tiering approach in BOD 26-04 actionable.

CREM surfaces risk across the full attack surface: cloud assets, endpoints, identity systems, and internet-exposed infrastructure. It maps exposure directly to the factors that BOD 26-04 uses for prioritization. This helps teams identify which vulnerabilities represent the highest real-world risk rather than just the highest Common Vulnerability Scoring System (CVSS) score. And with AI-driven attack timelines shrinking, having that prioritized view available continuously, not just during quarterly patch cycles, is becoming a core security requirement.

What do you think about the shift to risk-based vulnerability prioritization? I would love to hear your thoughts—follow me on X (formerly Twitter) to continue the conversation: @JonLClay.