Not all vulnerabilities require the same urgency. With BOD 26-04, organizations can develop a clear risk-based vulnerability management framework. We encourage all organizations to patch smarter, not harder. Get started:

@tech__unicorn I DMed Jackie on Instagram. Business of course.

“Patch smarter, not harder” is the right direction. BOD 26-04’s four-factor model (exposure, KEV status, exploit automation, and impact) is a meaningful improvement over pure CVSS-driven prioritization. The real test for most organizations will be whether they can continuously map asset exposure and act on the highest-risk combinations quickly enough.

Exposure + Exploitation + Automatability + Technical impact does not equal Risk. It is a proxy of likelihood of having an incident, but it misses the impact of the incident, the true Risk. A step closer to being a risk-based vulnerability management framework, but not there yet.

Is CISA interested in PQC data streaming systems?

Smarter patching still requires discipline. How do you prevent "risk-based" from becoming "we'll get to it later"?

Risk-based prioritization assumes you know your assets and their dependencies. What’s the most common blind spot that derails that approach?