Why Now? The AI Acceleration Problem

To understand the urgency, consider the baseline that existed before AI entered the picture. The median time for an organization to remediate half of its open, internet-facing vulnerabilities was 361 days. Meanwhile, exploitation of newly disclosed flaws happened in hours, not days or weeks. Research published in 2026 reveals that one-third of exploited Common Vulnerabilities and Exposure CVEs in the first half of 2025 showed attacker activity on or before the day of public disclosure, meaning defenders were already behind before they even knew a patch existed.

AI has made this asymmetry dramatically worse. Here is what the data reveals:

°   48,244 new CVEs were published in 2025 alone, a 20% year-over-year increase, with high-severity findings climbing 10% compared to 2024

°   CrowdStrike’s 2026 Global Threat Report documented a 42% year-over-year increase in zero-day vulnerabilities exploited before public disclosure.

°   Threat intelligence firm VulnCheck reported that 29% of KEV-level vulnerabilities in 2025 showed evidence of exploitation on or before the CVE’s publication date.

°   Cisco announced it would begin issuing vulnerability disclosures twice a month, citing the growing role of AI tools in uncovering security flaws faster than traditional security teams can triage and patch them.

°   Adversaries have demonstrated they can operationalize publicly disclosed exploits within two days of release.

Advanced AI models are now capable of scanning enormous codebases to identify previously unknown vulnerabilities, generate working exploits, and launch attacks, all with minimal human supervision. As Rob T. Lee of the SANS Institute observed, AI has transformed the economics of cyberattacks: operations that once required nation-state teams of thousands can now be executed by just two individuals with the right AI tooling.

The asymmetry is real, and it is growing.

What “Patch in 72 Hours” Actually Demands From an Organization

Whether or not an organization is bound by BOD 26-04, the directive signals where the entire industry is heading. CISA has explicitly encouraged private-sector organizations to adopt similar risk-based vulnerability management practices. Here is what achieving 72-hour patching capability actually requires:

1. Complete Asset Visibility

You cannot patch what you do not know exists. The CISA directive begins its clock the moment a vulnerability is added to the KEV catalog or the moment an agency identifies it on an asset, whichever comes first. Organizations with incomplete or outdated asset inventories will fail before they start. Continuous, automated asset discovery is not optional; it is a prerequisite.

2. Automated Patching Pipelines

Manual patching processes cannot meet 72-hour deadlines at scale. Organizations need automated vulnerability detection, prioritization, and patch deployment pipelines, ideally connected to threat intelligence feeds that flag KEV additions in real time.

3. Pre-Built Testing Frameworks

The reason organizations take weeks to patch is largely due to the time required to test that a patch does not break existing functionality. Organizations that maintain robust, automated regression testing environments can compress this step from days to hours.

4. Incident Response Readiness

BOD 26-04’s forensic triage requirement reflects a profound truth: a patch is not a recovery. If an attacker exploited a vulnerability before the patch was applied, remediating the flaw without investigating the intrusion leaves the attacker inside. Organizations need practiced incident response capabilities, not theoretical ones.

5. Vendor and Supply Chain Coordination

Many vulnerabilities involve third-party software embedded in organizational systems. CISA’s guidance acknowledges this complexity and directs agencies to contact vendors directly for patches or workarounds. Supply chain relationships need to be pre-established, not scrambled for under a 72-hour deadline.