The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a new binding directive requiring federal civilian agencies to patch critical software vulnerabilities in as little as three days. This change is driven by advances in artificial intelligence that enable attackers to discover and exploit security flaws at unprecedented speed. The directive replaces older timelines—15 days for critical bugs and 30 for high-severity ones—and introduces a four-part urgency rubric based on exposure, exploit automation, access level, and known exploitation status.

Under the new rules, any vulnerability that is publicly exposed, listed in CISA’s Known Exploited Vulnerabilities Catalog, fully automatable by attackers, and grants high-level access must be fixed within 72 hours. Agencies must also conduct forensic triage to determine if a breach has already occurred. The policy supersedes previous directives from 2019 and 2021, reflecting the accelerating threat landscape shaped by AI.

While the directive pushes for faster response, experts note it addresses only part of the challenge. Security leaders like Emily Long of Edera argue that without architectural changes to limit breach impact, faster patching alone won’t be enough. CISA officials acknowledge the directive is an initial step, with more systemic reforms likely needed as AI reshapes cyber defense.