{"id":1358,"date":"2026-09-09T15:18:26","date_gmt":"2026-09-09T13:18:26","guid":{"rendered":"https:\/\/www.cybi.fr\/?page_id=1358"},"modified":"2026-09-09T15:26:00","modified_gmt":"2026-09-09T13:26:00","slug":"bod-26-04-2","status":"publish","type":"page","link":"https:\/\/www.cybi.fr\/index.php\/en\/bod-26-04-2\/","title":{"rendered":"BOD 26 04"},"content":{"rendered":"\n
\n

BOD 26-04: Prioritizing Security Updates Based on Risk<\/h1>\n<\/div><\/div>\n\n\n\n
\n\n\n\n
\n
\n
\n
\n

Vulnerability backlogs don’t lie. Priority lists do.<\/h2>\n<\/div>\n\n\n\n
\n

CISA’s BOD 26-04 replaces CVSS-only scoring with four risk signals evaluated together. Download the whitepaper to see what changes, why it’s harder to operationalize than it looks, and where reachability-based analysis fits.<\/p>\n<\/div>\n\n\n\n

\n
\n
Download the whitepaper<\/div><\/a><\/div><\/div>\n\n\n\n
Read the resume<\/div><\/path><\/svg><\/span><\/a><\/div><\/div>\n<\/div><\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\"\"<\/figure>\n<\/div>\n<\/div><\/div>\n\n\n\n
\n
\n

3 Days<\/h2>\n\n\n\n

Remediation window when the four criteria are met<\/p>\n<\/div>\n\n\n\n

\n

4<\/h2>\n\n\n\n

Risk signals assessed jointly, not additively<\/p>\n<\/div>\n\n\n\n

\n

2019<\/h2>\n\n\n\n

Mandate led by the CVSS, replaced after seven years<\/p>\n<\/div>\n<\/div><\/div>\n\n\n\n

\n
\n
\n
\n
\n

Summary<\/p>\n\n\n\n

\n
    \n
  1. What changed : the directive, in detail<\/li>\n\n\n\n
  2. Why this is harder than it sounds<\/li>\n\n\n\n
  3. Where deterministic attack path analysis fits<\/li>\n\n\n\n
  4. Case study : a worked scenario<\/li>\n\n\n\n
  5. Takeways<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n
    \n

    What changed<\/h2>\n<\/div>\n\n\n\n
    \n

    On June 10, 2026, CISA published Binding Operational Directive 26-04, replacing the CVSS-driven remediation mandate in place since 2019. Vulnerabilities are now prioritized on four signals evaluated together like asset exposure, known exploitation, automatability, and technical impact, with a three-day remediation window for anything meeting all four.
    <\/p>\n<\/div>\n\n\n\n

    \n

    Why it’s harder than it looks<\/h2>\n<\/div>\n\n\n\n
    \n

    Each criterion sounds like a lookup. In practice, each one collapses into the same question: what does your network actually look like right now. A CVE feed and a spreadsheet can’t answer that. It takes modeling the network as a graph of reachability and privilege.
    <\/p>\n<\/div>\n\n\n\n

    \n

    Where deterministic attack path analysis fits<\/h2>\n<\/div>\n\n\n\n
    \n

    Rather than scoring vulnerabilities individually, this approach models assets, identities, and trust relationships as a graph, and computes, rather than estimates, which vulnerabilities sit on a real, reachable path to a meaningful target. The whitepaper walks through the mechanics and a worked scenario.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

    \n

    Download the whitepaper<\/h2>\n\n\n\t\t\t
    \n\t\t\t\t\t\t