You do not have four thousand critical vulnerabilities

The meeting goes the same way every time. Somebody runs a scanner across the estate, exports the result, sorts descending by CVSS, and presents a number. Four thousand criticals. Eleven thousand highs. The number is accurate and the presentation is useless, because the next question is which ones get fixed this month, and nothing in that sort order answers it.

The mistake is a category error rather than a process failure. A severity score describes a vulnerability: what it does to whatever it lands on, under assumptions about the target that were made by someone who has never seen your network. A remediation deadline describes your system: what that flaw is worth to somebody who wants in, given where the affected thing actually sits and what it is connected to. These are different objects. Sorting by the first produces a list; it does not produce a plan, and the gap between them is where vulnerability management programs die.

What makes this worth an article rather than a shrug is that the largest organization doing this at scale changed its mind about it recently, in public, with its reasoning attached.

What the federal government actually does now¶

From 2021, the operative instrument was BOD 22-01, which pointed federal civilian agencies at the Known Exploited Vulnerabilities catalog (opens in a new tab) and set uniform deadlines against it. The catalog is the useful half and it remains so: it lists only vulnerabilities observed being exploited in the wild, which makes it a smaller and more honest set than any scanner's critical list. When we read it on September 9, 2026 it held 1,699 entries. That figure moves, so treat it as a reading taken on a date rather than a fact about the catalog, but the order of magnitude is the point. It is thousands across the entire software industry over several years, not four thousand inside one company this quarter.

On June 10, 2026, Binding Operational Directive 26-04 superseded BOD 22-01 (opens in a new tab). It kept the catalog and threw away the uniform deadline. In its place is a table of remediation timelines that runs from three days at one end to “fix on system upgrade” at the other, and the position of any given vulnerability in that range is decided by four questions about the agency's own estate rather than by a score.

1. 1.Is the affected asset publicly exposed, or is it reachable only from inside?
2. 2.Is the vulnerability in the KEV catalog? That is, is anyone actually exploiting it?
3. 3.Can exploitation be automated, or does each target cost an attacker individual effort?
4. 4.Does a successful exploit yield total control of the component, or partial?

The worst cell in that table (publicly exposed, being exploited, automatable, total control) gets three days and a forensic assessment of whether you were already compromised, which is a detail worth pausing on. The directive treats that combination as a case where the honest question is not only whether you have patched but whether you were late. The best cell gets fixed whenever the system is next upgraded, and that is a real answer rather than an admission of defeat.

Why a decision beats a ranking¶

Underneath the directive is SSVC, the Stakeholder-Specific Vulnerability Categorization (opens in a new tab), developed at Carnegie Mellon's Software Engineering Institute with CISA. CISA's version evaluates exploitation status, technical impact, whether the flaw is automatable, mission prevalence, and public well-being impact, and it produces one of four outcomes: Track, Track*, Attend, or Act.

That output shape is the whole argument. A ranked list of four thousand items still has to be cut somewhere, and nothing in the list tells you where, so the cut gets made at whatever number this month's capacity happens to be, which means the boundary between fixed and not fixed is a staffing accident. A decision tree cuts at a stated reason. Act means somebody with authority is told now. Track means it goes in the ordinary queue. When a director asks why item 900 was not fixed, the answer stops being “we got to 400” and becomes “it is not exposed, nobody is exploiting it, and it yields partial control,” which is a position a person can defend or overrule on the merits.

It also changes what the security function is asking other teams for. A ranked list arrives at an operations team as an undifferentiated wall, and the rational response to an undifferentiated wall is to ignore it. Four Act items arrive as work.

Borrowing it when you are not a federal agency¶

None of this binds a private manufacturer or a clinic. It is worth borrowing anyway, and the adaptation is smaller than it looks, because three of the four factors are things you already know and the fourth is published.

Exposure you know, or you can find out in an afternoon, and the exercise of finding out is usually more valuable than the ranking it feeds. KEV status is a public list you can join against a scanner export mechanically. Automatability and impact are properties of the vulnerability that the advisory usually states outright. What you get at the end is not a better number; it is a short list with a reason attached to each row, and the reasons are the deliverable.

Two honest limits. First, this prioritizes; it does not reduce. A flaw that lands in Track is still a flaw, and a program that never works its Track queue has moved its backlog rather than shrunk it. Second, KEV is evidence of exploitation observed, which is not the same as exploitation occurring. Absence from the catalog is weak evidence, not a clean bill of health, and the automatable and exposure factors exist partly to cover that gap. Anyone selling you KEV as the whole answer is overselling a good list.

The test¶

Take your current backlog and ask what would have to be true for the top item to be genuinely more urgent than the item ranked five hundredth. If the only available answer is that it scored higher, the ranking is not carrying information about your business, and the four questions will tell you more in an hour than the sort order has told you all year. Re-ranking an estate this way, and being able to defend the cut afterwards, is part of our security testing work.