CISA: Internet-exposed, unauthenticated vulnerabilities should get fastest patch cycles

Jay Gasly described revised vulnerability timelines keyed to exposure: vulnerabilities that are "Internet connected" and do not require authentication should move to the fastest remediation tiers; he recommended nightly patch cycles for unauthenticated Internet-exposed flaws and said that, in some cases, even a three-day window may be too long.

Chris Day said exposure is the most important binary input agencies must consider: "Is it on the CAV? Is it exposed?" He urged organizations to reduce exposure where possible because doing so changes both priority and timelines. Tenable's analysis, cited on the webcast, found that removing the exposure component reclassifies roughly "91% of all those CVEs into tier 5," placing them in the fix-or-upgrade category under the new BOD rather than demanding immediate remediation.

Both speakers said agencies should integrate exposure signals into dashboards and automation to make rapid decisions about which vulnerabilities need immediate attention and which can be deferred so staff can focus on identity, monitoring and backup testing.