Summary
- CVSS scores measure theoretical severity, not real-world exploitability — attackers chain low-severity weaknesses and compromised credentials rather than waiting for unpatched CVEs.
- CISA’s Binding Operational Directive BOD 26-04 signals a formal shift toward exploitability-based prioritisation over score-driven patch queues.
- Point-in-time penetration tests provide roughly 24 hours of confidence; continuous autonomous testing is the emerging alternative, with the NSA’s CAPT program closing 71% of critical findings within 30 days.
- The ‘McNamara Fallacy’ analogy captures the risk of managing cybersecurity by what is easy to count — patches applied, tickets closed — while missing genuine attack exposure.
- Federal leaders are urged to prioritise validated attack paths, verify fixes by retesting rather than ticket closure, and adopt continuous testing across identity, cloud, and assumed-breach perspectives.
Federal security operations centres process millions of logs, scanner alerts and inventory feeds every day. The volume is not the problem. The problem is that raw data is not actionable intelligence, and the gap between the two is where adversaries operate. According to analysis published by CyberScoop, if you asked a room of federal CISOs to name the three weaknesses an adversary could exploit today, you would more likely receive a stack of compliance reports than a crisp, operationally grounded answer.
The exploitability gap
Traditional vulnerability management treats every CVE and high CVSS score as an equal emergency. The flaw in that approach is that CVSS scores are static abstractions: they cannot reveal whether a flaw is actually reachable in a given environment, whether it can be chained with other weaknesses, or whether exploitation would cause material mission damage. Security teams spend weeks addressing theoretical findings while adversaries identify and traverse real attack paths in hours. The article’s author — drawing on thirty years in IT operations and military cyber environments — describes routinely having to explain to auditors that a high-severity CVE was a false positive because the vulnerable module was not running or had been mitigated through other controls.
Credentials as the everyday zero-day
Attackers rarely need an exotic exploit. As Todd Beebe of Freeport LNG is quoted: “Credentials are the everyday zero-day.” Adversaries log in rather than hack in, using stolen credentials or weak trust relationships to move laterally. The source material notes that validated attack path analysis across thousands of organisations has demonstrated paths to critical impact without leveraging a single CVE — misconfigurations and identity weaknesses are sufficient. Closing a vulnerability ticket on schedule does not confirm that an attacker has been stopped.
The McNamara Fallacy applied to cyber
The article draws on the concept of the McNamara Fallacy — the tendency to manage by what is easiest to quantify while ignoring operational reality — to describe how federal cyber programmes risk mistaking compliance metrics for security outcomes. Patches applied, tickets closed, average CVSS scores: all measurable, none definitive. The author recounts leading a defence unit that was fully compliant with DISA STIGs, passed every audit, and still had findings a red team could immediately exploit. The lesson drawn is direct: it is considerably easier to be compliant than secure.
BOD 26-04 and the validation shift
CISA’s issuance of BOD 26-04 is described as a formal acknowledgement of what frontline defenders have long understood: agencies cannot win 90-day patch races against adversaries moving at machine speed, particularly as AI compresses the window between vulnerability disclosure and exploit execution. Frameworks including NIST SP 800-53 Rev. 5, NIST CSF 2.0, federal zero trust mandates, FedRAMP and Continuous Threat Exposure Management are collectively described as moving the market from static attestation toward active validation and verification — asking not whether a control is documented, but whether it stops realistic attacker behaviour right now.
Autonomous testing at scale
The NSA’s Continuous Autonomous Penetration Testing (CAPT) program is cited as evidence that continuous automated testing is viable in high-assurance environments. The program has logged 223,833 hours of operations across 28,282 completed penetration tests, spanning more than 3.7 million endpoints across 822 Defence Industrial Base organisations. It accelerated remediation by saving more than 340,000 labour hours and enabled lean security teams to close 71% of critical findings within 30 days — a meaningful contrast to the annual-audit model, where a test report may be operationally stale before remediation begins.
Three actions for security leaders
The source material sets out three concrete steps. First, define risk through exploitability and impact rather than theoretical CVSS rankings: prioritise validated attack paths that pose immediate mission risk. Second, move to continuous verification — testing controls, architectures and identity permissions from multiple perspectives including outside-in, assumed-breach, identity-based and cloud-native — rather than periodic assessments. Third, close tickets only after a targeted retest confirms the exploitable attack path is gone, not simply because a patch was deployed. As Corey Brunkow, Horizon3’s Director of Federal Operations, is quoted: “Compliance is the baseline, not the finish line.”
Why it matters
For CISOs — federal or otherwise — this piece crystallises a structural vulnerability in how most programmes are run: security posture is measured by activity rather than by whether an attacker can actually be stopped. The shift to continuous, exploitability-based validation is not a theoretical aspiration; BOD 26-04 and programs like CAPT indicate it is becoming an institutional expectation. Organisations still operating on annual penetration test cycles and CVSS-driven patch queues are likely overspending on low-risk findings while leaving genuine attack paths open. The identity and misconfiguration vectors highlighted here — not just unpatched CVEs — deserve explicit attention in threat modelling and control validation programmes.
What to do now
- Audit your vulnerability prioritisation process to confirm it accounts for actual exploitability and mission impact, not solely CVSS scores.
- Review whether your penetration testing cadence provides continuous coverage or only point-in-time snapshots, and assess whether autonomous testing capability could close that gap.
- Establish a verification step in your remediation workflow: tickets should close only after a targeted retest confirms the attack path has been eliminated, not merely that a patch was applied.
- Map identity-based and misconfiguration-based attack paths explicitly — do not assume CVE coverage equates to full attack surface coverage.
- Evaluate your programme against the compliance-versus-security distinction: determine whether your controls have been validated against realistic adversary behaviour or only documented for audit purposes.
