ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

Vulnerability management

CISA 3-day patch mandate abstract image with CISA logo over digital network lines

CISA Sets 3-Day Patch Mandate for Federal Agencies’ Most Dangerous Vulnerabilities

, , , , , , , , , ,

Federal agencies will have as little as three days to patch software vulnerabilities deemed most dangerous by CISA.

 

The Cybersecurity and Infrastructure Security Agency (CISA) issued a new directive requiring federal civilian agencies to fix the most dangerous software vulnerabilities within three days.

The directive, known as BOD 26-04, changes how federal agencies decide which software vulnerabilities need immediate attention. Instead of relying primarily on technical severity scores, CISA will now prioritize vulnerabilities based on their likelihood of being exploited by attackers and the damage they could cause.

Under the new system, agencies must fix the highest-risk vulnerabilities within three calendar days. Other vulnerabilities will have deadlines of 14 or 30 days depending on the level of risk identified by CISA.

CISA said the change is necessary because attackers are moving more quickly than ever. The agency specifically pointed to advances in AI that are helping attackers discover and target software vulnerabilities faster, reducing the time organizations have to respond.

“Defenders cannot afford to take weeks to patch systems that can be autonomously exploited en masse,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity, in a Reuters interview.

According to CISA, technical severity scores do not always reflect the actual danger posed by a vulnerability. Some highly rated vulnerabilities may never be exploited by attackers, while lower-rated vulnerabilities can become serious threats if actively targeted.

The new directive is designed to help agencies focus their resources on the vulnerabilities most likely to be used in real-world attacks.

Federal agencies must begin using the new approach immediately. CISA said the directive will create a more consistent process across government while helping agencies respond more quickly to emerging threats.

While the directive applies only to federal civilian agencies, it reflects a broader shift in cybersecurity. Organizations are increasingly looking beyond technical ratings and focusing on which vulnerabilities attackers are actually exploiting.

Google G logo with cybersecurity shield and padlock overlay on a blue digital background, illustrating Google's AI Threat Defense platform.

Google Launches AI Threat Defense to Patch Vulnerabilities Before Attackers Can Exploit Them

, , , , , , , , , , , ,

The system combines Gemini, Wiz, CodeMender, and Mandiant to continuously scan, prioritize, and patch security flaws without waiting for human intervention.

 

Google Cloud announced AI Threat Defense, a platform that scans enterprise systems for security vulnerabilities, ranks them by their exploitability and business impact, generates code fixes, and deploys patches automatically. It is the fourth major AI cyber defense tool launched by a frontier AI developer this year, following offerings from Anthropic, OpenAI, and Microsoft.

 

What it does

Google claims that AI Threat Defense goes beyond detecting threats and reporting them to cyber teams to fix. It prioritizes vulnerabilities by actual exploitability and business impact, then automates the fix from detection through deployment.

AI Threat Defense runs four steps in tandem: harden the environment, scan deeply for vulnerabilities, remediate them with AI-generated fixes, and monitor for new threats around the clock.

The platform draws on four components:

  1. Gemini handles reasoning and code analysis. 
  2. Wiz, which Google acquired in 2025 for $32 billion, maps live exposure across cloud infrastructure, applications, identities, and APIs and runs AI-driven penetration testing to validate which flaws can actually be exploited.
  3. CodeMender, developed by Google DeepMind, generates fixes directly inside a developer’s coding environment and verifies each patch before it goes live.
  4. Mandiant, acquired by Google in 2022 for $5.4 billion, contributes threat intelligence and response playbooks from frontline incident response work.

Google claims that using multiple “lighter” AI models rather than a single one allows each model to play to its strengths, enables broad and continuous scanning, while reserving frontier models for the highest-risk applications.

 

Where Google fits in the market

Google is the latest major AI developer to jump into the agentic AI cybersecurity space. In April, Anthropic made big news with its launch of Claude Mythic Preview, limiting access to a few dozen testing partners out of concern the AI model was “too powerful” to release.

Soon after, OpenAI released ChatGPT-5.5-Cyber, also limiting access to cybersecurity professionals by vetting applicants through its Trusted Access for Cyber (TAC) program.

Most recently, Microsoft introduced MDASH, a cybersecurity system of multiple AI models that work together to analyze software code and identify weaknesses.

All have shown strong ability to surface previously undetected threats at scale. Google’s AI Threat Defense also claims this but goes further by automatically fixing vulnerabilities, a step the others leave to the client’s engineers. Whether that distinction holds up in production environments is untested at scale. Early partners deploying the platform include Accenture, Deloitte, PwC, and Netenrich.

 

AI Threat Defense is available through Google Cloud.