6/23/26 CISA has introduced a new risk-based vulnerability remediation framework that shortens the timeline for addressing the highest-risk vulnerabilities. The move is intended to reflect today’s threat landscape where threat actors are increasingly exploiting vulnerabilities and AI and automation are only accelerating the speed at which attackers can identify, weaponize, and scale exploitation.
From a CISO perspective, the three-day and 14-day patching requirement stated by CISA is a meaningful improvement over traditional patching cycles, but it also raises an important question: is three days fast enough for internet-facing, actively exploited vulnerabilities? Mandiant’s M-Trends 2026, https://lnkd.in/gYkxNt9E, discloses that the mean time to exploit vulnerabilities is estimated at -7 days, revealing exploitation that is regularly occurring before a patch is even available.
The broader point for security executives is that as attack timelines continue to compress, security teams must compress their response timelines as well. In an era of AI-enabled attacks and rapidly weaponized zero-days, organizations, such as CISA, need vulnerability management programs designed for speed, visibility, and risk-based decision making.