Answer Brief
CISA’s Vulnerability Review for FY2024–2025 shows most compromises stem from basic security failures and known vulnerabilities, not advanced tools, urging organizations to prioritize fixes using risk-based frameworks and Secure by Design principles.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
CISA publishes Vulnerability Review for FY2024–2025
- 2
Data collection period begins for vulnerability analysis
- 3
Data collection period ends for vulnerability analysis
- 4
Reference to Binding Operational Directive 26-04 for risk-based prioritization framework
Executive Summary: CISA’s Vulnerability Review for FY2024–2025 shows most compromises stem from basic security failures and known vulnerabilities, not advanced tools, urging organizations to prioritize fixes using risk-based frameworks and Secure by Design principles.
Why It Matters
The CISA Vulnerability Review for Fiscal Years 2024 and 2025 delivers a clear, evidence-based message: the majority of successful cyber compromises do not depend on zero-day exploits, sophisticated malware, or nation-state-grade tools. Instead, threat actors consistently succeed by scanning for and exploiting well-known, unpatched vulnerabilities that organizations have failed to address due to basic security hygiene gaps. This finding underscores a persistent gap between awareness and action in vulnerability management, where known risks remain unmitigated despite available patches and guidance. By analyzing real-world vulnerability data from CISA and open sources, the review establishes a critical baseline of the current threat landscape—specifically capturing conditions before AI-enabled vulnerability discovery becomes more prevalent. This timing is significant, as it provides a reference point for measuring how AI might shift both offensive and defensive vulnerability dynamics in the near future. Organizations can use this baseline to assess whether their exposure to known flaws is decreasing or if systemic issues persist. A core contribution of the review is its emphasis on shifting from reactive defense to proactive prevention through Secure by Design principles. Rather than treating vulnerabilities as inevitable flaws to be patched after discovery, the report advocates for building security into the software development lifecycle so that entire classes of weaknesses—such as memory safety issues or injection flaws—are eliminated before code reaches production. This approach reduces the attack surface at the source and lessens the burden on defensive teams. The review also provides practical guidance on prioritization, directing organizations to adopt the risk-based framework from Binding Operational Directive 26-04. This framework evaluates vulnerabilities using four objective criteria: whether the asset is exposed to the internet, its presence in the Known Exploited Vulnerability (KEV) Catalog, the likelihood of automated exploitation, and the potential technical impact if compromised. By applying these factors, teams can move beyond CVSS scores alone and focus remediation on the vulnerabilities that pose the greatest real-world risk. Furthermore, the review encourages organizations to look beyond individual CVEs and identify recurring patterns in vulnerability data. By recognizing common root causes—such as insecure coding practices, lack of input validation, or poor dependency management—software producers and users alike can implement systemic fixes that prevent entire categories of flaws from emerging. This shift from tactical patching to strategic improvement is presented as essential for long-term risk reduction. The document is explicitly tailored for a broad audience, including federal agencies, critical infrastructure operators, industry leaders, and small businesses, reflecting the universal relevance of its findings. Its availability in English and as a downloadable PDF ensures accessibility across sectors and organizational sizes. The review does not speculate about future threats or attribute incidents to specific threat actors; instead, it grounds its recommendations in observable data and established policy. For global security, AI security, cloud, identity, and operations teams, the review serves as a reminder that foundational controls often deliver the highest return on investment. Even as AI introduces new complexities in threat detection and vulnerability discovery, the basics—knowing what is exposed, what is actively exploited, and what can be automated—remain central to effective risk management. Teams should use this review to validate their vulnerability prioritization processes, reinforce Secure by Design advocacy in development teams, and ensure alignment with binding directives like BOD 26-04. Looking ahead, organizations should monitor how AI-driven vulnerability discovery tools may change the volume and velocity of flaw identification, potentially increasing the pressure to remediate known issues faster. The review’s baseline data will be valuable for measuring such shifts. Additionally, tracking adoption of Secure by Design practices across software supply chains—particularly in critical technology sectors—will be key to assessing whether the industry is making progress on eliminating preventable flaws at the source.
Event Type: security
Importance: high
Affected Sectors
- Critical Infrastructure
- Federal Government
- Industry
- Small and Medium Businesses
- State, Local, Tribal, and Territorial Government
Key Numbers
- Publication Date: August 26, 2026
- Report Coverage: Fiscal Years 2024 and 2025
- Document Size: 3.43 MB
- Language: English
Timeline
- CISA publishes Vulnerability Review for FY2024–2025
- Data collection period begins for vulnerability analysis
- Data collection period ends for vulnerability analysis
- Reference to Binding Operational Directive 26-04 for risk-based prioritization framework
Frequently Asked Questions
What is the main finding of the CISA Vulnerability Review for FY2024–2025?
The review finds that most compromises result from basic security failures and exploitation of well-known vulnerabilities, not advanced techniques or cutting-edge tools, highlighting the need for fundamental security improvements.
How does the CISA Vulnerability Review suggest organizations prioritize vulnerabilities?
The review recommends using the framework from Binding Operational Directive 26-04, which evaluates vulnerabilities based on exposure status, KEV Catalog status, potential for automated exploitation, and technical impact.
What role do Secure by Design principles play in the CISA Vulnerability Review?
The review demonstrates that Secure by Design principles are essential for shifting cybersecurity from reactive threat response to proactive elimination of preventable software flaws at the source.
Who is the intended audience for the CISA Vulnerability Review?
The review is intended for executives, federal government, industry, small and medium businesses, and state, local, tribal, and territorial government organizations.
Why is the CISA Vulnerability Review considered a baseline for today’s vulnerability landscape?
It analyzes CISA and open source data from FY2024–2025 to establish a pre-AI-enabled vulnerability discovery baseline, helping organizations understand current risk patterns before widespread AI-driven threat evolution.