CISA Cuts Federal Patching Window to 3 Days for Critical Flaws; AI-Driven Vulnerability Pace Cited
The directive forces a triage problem downstream: if an agency's security operations center cannot validate and deploy a patch in three days, it either accepts unpatched critical systems or patches without validation and risks introducing new vulnerabilities.
This creates a perverse incentive for agencies to defer classification of vulnerabilities as 'critical' — watch for pushback from CISO offices arguing their systems don't meet the severity threshold.
For defense contractors with facility security clearances, this will cascade into their own patch management policies, potentially creating supply-chain friction where primes demand faster patching from subcontractors who lack the automation infrastructure.
This compresses the operational tempo for every federal agency's IT security team — not just DoD, but Treasury, State, Energy, and all civilian agencies managing classified or critical infrastructure systems.
The three-day window for critical flaws means incident response becomes the baseline operating mode rather than a periodic task, forcing agencies to choose between staffing surge capacity or accepting systemic risk. Watch whether agencies request emergency hiring authority in the FY27 supplemental, or whether the Office of Management and Budget revises the timeline downward after the first quarter of implementation.
Does the three-day mandate apply to air-gapped or legacy systems that cannot patch automatically, or does CISA provide exemption criteria? How does this interact with existing DoD RMF recertification timelines, which typically require 60-90 days post-patch?
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.