CISA BOD 26-04 Has Broken the Patch-Everything Model.
A 72-Hour Clock is Now the Standard.
Federal agencies must move from patch volume to measurable risk elimination.
BOD 26-04 requires the highest-risk exposures to be remediated within 72 hours, with forensic triage before patching.
Get your custom briefing today.
Days Hour Min
Don't Let the Clock Run Out
Manage Risk in the Post-Mythos Era
Operationalize your transition to autonomous remediation with Qualys.
Operationalize continuous, auditable risk reduction with a federal Risk Operations Center powered by Qualys.
What is BOD 26-04?
Federal Vulnerability Management Has Changed.
CISA BOD 26-04 moves federal agencies from patch-everything strategies to risk-based vulnerability management. The highest-risk exposures must be remediated within 72 hours, with forensic triage required before patching.
Live
Webinar
Live Webinar
FedRAMP Authorization and What It Now Takes to Keep It
Wednesday, Sept 2nd | 9:00 AM PT | 12:00 PM ET
Join Kaleb Knobel, Senior Security Analyst & ISSO and Anu Kapil, Director of Product Management at Qualys for a practical walkthrough of what VDR and VER change across FedRAMP Moderate and High environments.
Webinar
FedRAMP Authorization and What It Now Takes to Keep It
Join Kaleb Knobel, Senior Security Analyst & ISSO and Anu Kapil, Director of Product Management at Qualys for a practical walkthrough of what VDR and VER change across FedRAMP Moderate and High environments.
Kaleb Knobel
Senior Security Analyst & ISSO
Anu Kapil
Director of Product Management
Security and IT operations need a shared operating model — one that replaces manual handoffs with continuous, automated workflows across detection, prioritization, and remediation.
This is the foundation of the Risk Operations Center (ROC) powered by Qualys.
Asset Exposure
Is the asset publicly / internet exposed?
KEV Status
Is the CVE on CISA's Known Exploited Vulnerabilities catalog?
Exploit Automation
Can an adversary fully automate every step of exploitation?
Technical Impact
Does exploitation give partial or total control of the asset?
Autonomous Validation Orchestration
Mythos has turned vulnerability discovery into a continuous, automated race. What used to take weeks can now compress into hours, and the volume of disclosures keeps climbing. But the real concern for CISOs is not the flood of findings. It is the small number that are confirmed, weaponized, and reachable in your environment.
The window to act is shrinking. The question is whether your program was built to find signal in the noise before an attacker does it for you.
On April 7, 2026, Anthropic announced Claude Mythos Preview, a frontier AI model under Project Glasswing capable of autonomously discovering and exploiting software vulnerabilities. Released as a private beta with selected partners, its goal is to identify and remediate critical vulnerabilities in commonly deployed software before adversaries discover and exploit these.
The result is a new era of accelerated vulnerability discovery, driving a surge in disclosures, patches, and CVEs at a pace security teams have never had to manage before.
Mythos marks a structural shift in vulnerability management: discovery is becoming continuous, automated, and massively scaled. Vulnerabilities that once took human researchers weeks or months to uncover can now be identified and exploited in hours.
This is compressing the exploitation window and accelerating disclosure cycles, creating a growing gap between “vulnerability found” and “risk actually remediated.” At the same time, the volume of findings is increasing dramatically, while only a small fraction of vulnerabilities are ever truly exploited.
The Current Situation:
The vulnerability volume is up, the remediation timelines are shorter and the handoffs between security and IT are still largely manual, creating a gap where more gets found than fixed, and neither team has full confidence in what's actually exploitable.
That misalignment isn't a people problem. It's an operating model problem.
The Current Situation:
The vulnerability volume is up, the remediation timelines are shorter and the handoffs between security and IT are still largely manual, creating a gap where more gets found than fixed, and neither team has full confidence in what's actually exploitable.
That misalignment isn't a people problem. It's an operating model problem.
The vulnerability volume is up.
The result is a gap that keeps growing:
The Problem Your Team Is Living Every Day:
The vulnerability volume is up.
The remediation timelines are shorter.
And the handoffs between security and IT are still largely manual.
The Result Is a Gap That Keeps Growing:
Security finds more than IT can fix
IT fixes things security didn't flag as urgent
Neither team has full confidence in what's actually exploitable
The New Reality
AI Has Compressed Exploitation Timelines. From Weeks To Hours.
BOD 26-04 is CISA's response to a new threat landscape where attackers can discover and weaponize vulnerabilities faster than traditional remediation programs can respond.
disclosed in 2025
became weaponized and were added to the KEV catalog
Maximum remediation window for the highest-risk exposures
Not every vulnerability deserves the same response.
BOD 26-04 replaces blanket, CVSS-driven remediation with risk-based prioritization.
Agencies must evaluate vulnerabilities based on exposure, exploitability, and impact.
Better alignment with IT execution workflows
An AI-Native Risk Operations Center combines AI-speed detection, hyper-prioritization, exploitability validation, and risk-based remediation into a continuous operating model focused on measurable risk reduction.
An AI-Native Risk Operations Center combines AI-speed detection, hyper-prioritization, exploitability validation, and risk-based remediation into a continuous operating model focused on measurable risk reduction.
Qualys delivers a unified, AI-powered platform to power the ROC, eliminating tool sprawl so security and IT operate as one. The Qualys Government Platform is FedRAMP High authorized, with 400+ inherited technical controls to streamline FISMA, OMB, and Zero Trust reporting, and it moves agencies beyond compliance to sustainable, mission-aligned cybersecurity.
Security and IT operations need a shared operating model — one that replaces manual handoffs with continuous, automated workflows across detection, prioritization, and remediation.
This is the foundation of the Risk Operations Center (ROC) powered by Qualys.
Detect exposures before attackers can weaponize them.
#1 Coverage For CVEs & KEV
Cut the noise. Focus on validated risk.
99.9% Noise Reduction
Close the highest-risk gaps at machine speed.
150M+ Patches Deployed
MTTR for CISA KEV on Internet Facing Assets: 14 Days Eliminate customers vs 49 Days non customers
Patches deployed
Autonomous Remediations
<0.1%: Rollback Rate
HOUR 0 - Detect
InstaScan, powered by Agent Insta automatically correlates newly published CVE advisories against live asset inventories, rapidly identifying affected assets within minutes of disclosure.
HOUR 0 - Prioritize
HOUR 1 - Validate
HOUR 4 - Remediate
HOUR 8 - Revalidate
Delivering Efficiency in Cyber Risk Management for Federal Agencies with a Risk Operations Center
Federal agencies, suppliers, and commercial organizations seeking the highest levels of cybersecurity face mounting challenges
CISA BOD 26-04 is a mandate for federal civilian agencies that shifts from blanket patching to risk-based vulnerability management. It requires these agencies to remediate high-risk, publicly exposed, and known-exploited vulnerabilities that grant system control within a strict 3-day (72-hour) SLA.
Qualys helps agencies comply through its Federal Risk Operations Center (ROC) model. By utilizing Qualys VMDR, Enterprise TruRisk Management (ETM), and TruRisk Eliminate together, teams can efficiently automate detection, hyper-prioritize real-world exposures, and orchestrate rapid remediation to meet the strict 72-hour SLA.
It evaluates exposures based on real-world context rather than treating all vulnerabilities equally. Prioritization requires assessing internet exposure, CISA KEV (Known Exploited Vulnerabilities) alignment, real-world exploitability, and specific asset criticality or mission impact instead of just relying on CVSS scores.
Yes, the Qualys Government Platform is FedRAMP High Authorized. This certification ensures Qualys provides full-spectrum, hardened cyber risk operations to secure highly sensitive federal workloads and accelerate Authority to Operate (ATO) across demanding government environments.
Unlike CVSS alone, Qualys TruRisk evaluates evidence of active exploitation, exploit code maturity, asset criticality, and compensating controls. This comprehensive context reduces the number of critical vulnerabilities to prioritize by up to 85%, ensuring teams focus on operational risks that matter.
BOD 26-04 mandates a strict 72-hour (3-day) remediation deadline for the highest-risk vulnerabilities—specifically those that are publicly exposed and known-exploited. Lower-risk vulnerabilities can continue to be managed through normal, established change management processes.
The Qualys Government Platform offers unified, continuous visibility across IT/OT, cloud, and container environments. It aggregates risk factors, validates fixes in hours to prevent drift, and aligns seamlessly with federal mandates like DHS’s Continuous Diagnostics and Mitigation (CDM) goals.
Prepare Your Agency For The 72-Hour Era.
Operationalize continuous, auditable risk reduction with a AI Risk Operations Center powered by Qualys
Prepare Your Agency For The 72-Hour Era.
Operationalize continuous, auditable risk reduction with a AI Risk Operations Center powered by Qualys.
