CISA's Binding Operational Directive (BOD) 26-04 replaces BOD 19-02 and BOD 22-01, ending federal agencies' reliance on static CVSS scores for vulnerability prioritization. The new directive mandates a dynamic, risk-based model built on four variables: asset exposure, KEV status, exploit automation, and technical impact. Tenable One maps directly to these four variables, offering continuous asset discovery, attack surface management, and AI-powered prioritization via Tenable Hexa AI. Key data points include: removing internet exposure can shift 76.7% of CVEs to deferral tiers, 83% of actively exploited CVEs yield total system control (triggering a 3-day remediation + forensic triage requirement), and 61% of actively exploited vulnerabilities cannot be fully automated. The platform also automates CDM asset tagging for Phase 3 compliance and extends coverage to cloud and third-party environments via Tenable One Cloud Exposure.
