CISA gives federal agencies 72 hours to fix critical flaws as AI speeds up cyberattacks
Under a new CISA directive, federal agencies now have just 72 hours to address critical flaws as officials warn AI is helping hackers move faster than ever.
Thomas Fuller/SOPA Images/LightRocket via Getty Images
The US cyber defense agency said on Wednesday that government officials now have three days to deal with the most serious categories of digital vulnerabilities in their networks, a compressed timeline that is due in part to hackers' use of artificial intelligence.
- Federal agencies must now fix, disable, or remove the most critical internet-facing vulnerabilities within three calendar days.
- CISA says advances in AI are helping attackers exploit software flaws faster, shrinking the window defenders have to respond.
- Lower-risk vulnerabilities will follow a tiered remediation schedule ranging from two weeks to as long as 60 days.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The deadline, which was set in a new directive issued by the US Cybersecurity and Infrastructure Security Agency (CISA), obligates civilian federal agencies with vulnerable software or equipment to fix, disable, or remove it from the internet within three calendar days, depending on the severity of the threat.
Many cyber experts worry that new, more capable AI models along the lines of Anthropic's Mythos are supercharging hackers' abilities to take advantage of digital vulnerabilities across the internet, forcing defenders to plug security holes almost as soon as they are discovered.
The directive said that because the window to respond to hacks was potentially narrowing, "we must take immediate action to harden American networks" and make sure government policies for applying fixes are up to the task.
"Defenders cannot afford to take weeks to patch systems that can be autonomously exploited en masse," CISA Acting Executive Assistant Director for Cybersecurity Chris Butera told reporters. He said the directive was "an initial step to counter the increased capabilities of those emerging AI models."
Reuters first reported last month that US officials were considering the adoption of a three-day deadline to deal with potentially dangerous flaws.
Even under the new directive, there is still more time to deal with less severe weaknesses, such as ones that are not easy for hackers and cybercriminals to automate, or do not concern publicly exposed digital infrastructure.
An appendix to the order leaves two weeks to deal with many vulnerabilities and as long as two months for the least serious category of flaw.
CISA did not immediately return a message seeking comment.
Has your password leaked?
Unlock more exclusive Cybernews content on YouTube.