The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a new directive that compresses the remediation timeline for the most dangerous digital vulnerabilities in federal civilian networks to three calendar days. The directive requires agencies that identify vulnerable software or hardware to either fix the issue, disable the affected component, or remove it from internet exposure within the specified short window, depending on how severe the threat is.
CISA attributed part of the urgency to the growing use of artificial intelligence by malicious actors. The agency said that because the time frame within which hackers can exploit newly discovered flaws appears to be shrinking, "we must take immediate action to harden American networks" and ensure government policies for applying fixes are capable of keeping pace.
The directive does not impose the three-day deadline across the board. For vulnerabilities that are less likely to be automated by attackers or that do not involve publicly exposed infrastructure, the order allows more time. An appendix to the directive specifies that many such weaknesses must be addressed within a two-week period, while the least serious category of flaws can be remediated within as long as two months.
The agency's move follows reporting that U.S. officials were weighing a three-day requirement. Cybersecurity specialists have expressed concern that more capable AI models - such as Anthropic's Mythos, cited in the directive - are enabling attackers to identify and weaponize vulnerabilities more efficiently, increasing pressure on defenders to close security gaps almost immediately after discovery.
The new timeline directly affects civilian federal agencies that operate vulnerable systems and equipment connected to public networks. It also has implications for the contractors and service providers that support those agencies, and for firms in the cybersecurity sector that provide vulnerability management and patching solutions.
CISA did not immediately return a message seeking comment.
What this means
- Federal civilian networks face significantly faster mandatory response requirements for the highest-severity vulnerabilities.
- Organizations responsible for government infrastructure will need to ensure operational processes and patch management can meet substantially tighter deadlines.
- Vendors and managed security providers may see increased demand for rapid remediation services and automated tooling.