Key facts
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a new directive.
- Federal agencies must now address the most serious digital vulnerabilities within three calendar days.
- The accelerated timeline is influenced by the growing capabilities of AI in cyberattacks.
- Less critical vulnerabilities will still have longer remediation windows, up to two months.
- The directive aims to harden American networks against rapidly evolving threats.
The U.S. has shortened the window for federal agencies to fix critical digital vulnerabilities to three days, a move driven in part by the increasing use of artificial intelligence by malicious actors. The directive, issued by the Cybersecurity and Infrastructure Security Agency (CISA), mandates that civilian federal agencies must address, disable, or remove the most serious software or equipment vulnerabilities within this compressed timeframe.
Cyber experts note that advanced AI models are enhancing hackers' capabilities to exploit digital weaknesses, necessitating a faster response from defenders. CISA stated that the narrowing window to respond to hacks requires immediate action to strengthen American networks and ensure government policies are adequate.