CISA ends weekly vulnerability roundups as part of shift to prioritization approach

[ahouseholder]

https://www.cybersecuritydive.com/news/cisa-vulnerability-bulletins-sunset-prioritization/830779/

As vulnerabilities swamp defenders in the AI era, CISA has shifted to a risk-based approach to vulnerability management. In July, the agency issued new vulnerability remediation guidelines to other agencies that set deadlines based on several criteria, including whether targeted assets are internet-accessible and whether exploitation can be automated. While the guidelines are binding only on federal agencies, CISA has urged non-government organizations to follow the same approach by evaluating their unique risk exposure when making remediation decisions.

“Not all vulnerabilities matter,” Lindsey Cerkovnik, CISA’s branch chief for vulnerability response and coordination, said at the DEF CON hacker conference in August. “Not all vulnerabilities that do matter matter at the same level for you and your organization.”

CISA said in its Thursday statement that sunsetting the bulletin aligns with the prioritization directive it issued in July, “which directs federal agencies to prioritize vulnerabilities based on real‑world risk factors, including evidence of exploitation and exposure, rather than severity scores alone.”

As it discourages organizations from relying solely on Common Vulnerability Scoring System (CVSS) scores to decide which vulnerabilities to fix, CISA has also been highlighting the Stakeholder-Specific Vulnerability Categorization (SSVC) system as a more nuanced approach to vulnerability analysis.