AI changed the game. Smart security isn't about patching everything — it's about stopping the attack paths that matter most.
CISA’s new Binding Operational Directive (BOD) 26-04 marks one of the most important changes to federal vulnerability management in years. Rather than requiring agencies to patch every critical vulnerability on the same timetable, the directive prioritizes remediation based on risk, with patch deadlines ranging from three days for the highest-risk vulnerabilities to deferral for those posing minimal risk. It’s a welcome evolution, but it brings us to the starting blocks, not the finish line.
Security teams have long known that severity alone doesn’t determine risk. A CVSS score says little about whether a vulnerability is reachable from the Internet, is being actively exploited, can be automated or provides the attacker with control of the asset. BOD 26-04 acknowledges the contextual nature of risk by directing organizations to focus first on the exposures most likely to be exploited.
However, AI is compressing every stage of the attack lifecycle, changing the threat landscape faster than vulnerability management practices can adapt. CrowdStrike reports that the average eCrime breakout (Initial Lateral Movement) time has fallen to just 29 minutes, with the fastest observed breakout taking 27 seconds. Once attackers establish a foothold, Mandiant found they hand off access between operators in a median of 22 seconds.
At the same time, AI itself is growing as an attack surface. Organizations are rapidly deploying copilots, browser agents, autonomous workflows and other AI-powered systems, introducing prompts, plugins, connectors and integrations that require protection.
Against this backdrop, the directive’s three-day remediation window for the riskiest exposures looks less like an aggressive target and more like a luxury.
Today’s attackers don’t simply exploit CVEs. They combine vulnerabilities with stolen identities, cloud misconfigurations, exposed APIs, SaaS weaknesses and increasingly AI systems to construct attack paths into critical assets. BOD 26-04 moves us forward, but AI requires defenders not simply to accelerate existing processes, but to rethink them.
AI has changed the tempo and economics of cyberattacks
One of AI’s biggest advantages for attackers is its ability to automate work that previously required teams of human operators. Reconnaissance, vulnerability research, exploit generation, phishing, credential harvesting and even portions of lateral movement can now be accelerated or, in some cases, largely orchestrated by AI.
Recent research has demonstrated autonomous agents carrying out much of the operational work in sophisticated cyber campaigns while humans supervise the broader objectives. As a result, campaigns become easier and less expensive to scale, more targets can be pursued simultaneously and attackers can test far more paths into an environment before defenders realize they’re being probed.
For years, vulnerability management assumed that organizations had weeks, or even months, to identify, prioritize and remediate security issues. That assumption no longer reflects reality. Attackers routinely move from initial access to lateral movement in less than an hour, and vulnerabilities are increasingly exploited shortly after disclosure, and in some cases are weaponized before defenders have even begun evaluating them.
This is why CISA’s move toward risk-based remediation matters. Prioritizing vulnerabilities based on exploitability and operational risk gives defenders a much better chance of addressing the issues most likely to be used against them. But vulnerabilities represent only one piece of today’s exposure landscape.
Modern attacks follow paths, not findings
Most security organizations still divide responsibilities across specialized teams. Vulnerability management focuses on CVEs. Identity teams concentrate on authentication and privilege. Cloud security addresses configuration. Application security reviews code.
Attackers don’t encounter those same boundaries. Their objective is to reach valuable assets using whatever route is available. A campaign may begin with an exposed vulnerability, stolen credentials, excessive cloud permissions, a misconfigured SaaS application or a compromised AI agent. More often than not, several of those conditions are combined. For example, the 2026 Verizon Breach report found that while 31% of initial exploitation last year was a vulnerability, 39% of attack chains involved identity issues. In every notable breach, attackers chain together various types of exposures to advance inside networks.
An attacker who compromises a low-privilege account may discover an over-permissioned identity, pivot through a cloud workload, exploit a vulnerable application and eventually gain access to sensitive business systems. None of those individual exposures may appear catastrophic when viewed independently. Together, they form a viable attack path.
With breaches always a chain of various exposures, and vulnerabilities representing only part of the story of how breaches actually occur, this is where vulnerability-centric security begins to break down. CrowdStrike also reported a 42% year-over-year increase in vulnerabilities exploited, before vendors even announced them. That means organizations that are nose-to-the-grindstone closing hundreds of high-severity findings will get breached because they lack the context needed to close off the most practical route an attacker would take to their critical assets.
Organizations should assume breach and plan for the possibility that an attacker will eventually gain an initial foothold. Security architecture should be as segmented as possible and limit how far an adversary, or a compromised AI agent, can move after that initial compromise. And security controls should be validated continuously rather than assumed effective because they were successfully deployed.
These principles shift attention away from individual findings and toward the conditions that enable successful attacks.
How defenders can adapt: Continuous assessment and validation
One practical way to make this transition is to get serious about implementing a Continuous Threat Exposure Management (CTEM) program, which establishes an ongoing process for understanding and reducing exposure.
It starts with something many organizations still struggle to maintain: a current understanding of the environment. That means continuously mapping assets, identities, cloud infrastructure, SaaS applications, AI systems and the relationships between them. From there, security teams can identify exposures, prioritize them according to exploitability and business impact, validate whether they are actually reachable, and drive remediation across operational teams.
This continuous cycle restores what Mandiant calls the Defender’s Advantage. Attackers must first discover an unfamiliar environment before they can exploit it. Defenders already have that knowledge – or should. The challenge is keeping it current as cloud services, identities, AI applications and business systems evolve daily.
Embed validation into the process
Security teams also need to verify that the exposures they’ve identified can actually be exploited and that remediation efforts have eliminated meaningful risk.
That’s where adversary-aware exposure validation becomes an essential part of the process. Technologies such as breach-and-attack simulation, automated penetration testing and attack path analysis allow organizations to continuously test their environments using techniques that resemble real adversaries.
Instead of asking whether a vulnerability exists, exposure validation answers more practical questions: Can an attacker reach it? Can they exploit it? Can they pivot from it to something the business actually cares about? Just as important, validation confirms whether remediation efforts have truly closed the door rather than simply reducing the number of findings on a dashboard.
Prioritize the business, not the dashboard
Validation becomes even more valuable when combined with business context. A medium-severity weakness affecting a revenue-generating application, regulated data or critical operational system may represent greater organizational risk than multiple critical vulnerabilities affecting isolated development environments.
Prioritizing validated exposures according to business impact gives security leaders a remediation strategy they can explain to executives in operational terms rather than technical ones. More importantly, it aligns defensive efforts with the attack paths most likely to affect the organization.
BOD 26-04 is an important step forward. But AI has already made risk-based patching table stakes. In the AI era, the organizations that succeed won’t necessarily be those that patch the fastest. They’ll be the ones that understand their exposure better than the attackers trying to exploit it.
This article is published as part of the Foundry Expert Contributor Network.
Want to join?