The Cybersecurity and Infrastructure Security Agency has issued a new directive requiring federal agencies to fix certain security vulnerabilities within three days. The move comes as artificial intelligence enables attackers to exploit flaws faster than ever before.

On Wednesday, a CISA official warned that defenders can no longer rely on weeks-long patching cycles. The agency is responding to a shift in the threat landscape where AI tools can automatically scan for and weaponize newly disclosed bugs within hours.

The directive applies to vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. Agencies must remediate these specific bugs within 72 hours or face compliance action. Previously, the standard remediation timeline was seven days for critical vulnerabilities.

Background on the New Patching Timeline

CISA maintains the KEV catalog as a list of vulnerabilities that have been actively exploited in the wild. When a new bug is added, agencies must act quickly to close the security gap.

The three-day window only applies to vulnerabilities categorized as “Type 1” under Binding Operational Directive 24-02. These are flaws that pose the most immediate risk to federal networks.

For lower severity bugs, agencies continue to have longer timelines: 14 days for Type 2 vulnerabilities and 30 days for Type 3. The expedited three-day deadline is reserved for the most dangerous exploits.

AI Threats Reshaping Vulnerability Response

Security researchers have observed a dramatic acceleration in the time between a vulnerability’s public disclosure and its first exploitation. AI-powered tools can now generate exploit code in minutes.

The CISA official cited specific cases where AI-driven scanning tools identified vulnerable systems within hours of a patch being released. Attackers then use these tools to compromise unpatched systems before organizations can deploy fixes.

This “window of opportunity” for defenders is shrinking. What once took weeks or days now takes hours. The new directive reflects this compressed timeline.

Implications for Federal Networks and Contractors

Federal agencies must immediately assess their vulnerability management processes. Many agencies currently rely on monthly patching cycles, which are no longer adequate for critical threats.

The directive also applies to contractors and third-party service providers that operate federal information systems. They must be able to deploy emergency patches within the same 72-hour window.

Organizations that fail to comply risk losing their authority to operate federal systems. CISA has the power to issue binding orders and can escalate noncompliance to agency leadership.

Challenges in Implementing the Three-Day Deadline

Meeting a 72-hour patching deadline presents logistical challenges. Large agencies must coordinate across multiple IT departments, test patches for compatibility issues, and deploy updates to thousands of endpoints.

Smaller agencies with limited cybersecurity staff may struggle to keep up with the accelerated timeline. Some may need to invest in automated patch management systems or managed security services.

CISA has published guidance on how to prioritize patching efforts. The agency recommends using automated scanning tools to identify vulnerable assets and deploying critical patches first.

Expected Next Steps

CISA plans to update the KEV catalog more frequently as AI threats evolve. The agency is also developing automated alerting systems to notify agencies immediately when new critical vulnerabilities are added.

Industry observers expect other countries to adopt similar accelerated patching requirements. The European Union and several Asian nations have already signaled interest in CISA’s approach.

CISA will conduct compliance audits within 90 days of the directive’s issuance to ensure agencies are meeting the new deadlines. Further revisions to the binding directive may follow as the threat landscape continues to change.