The CISA Vulnerability Review highlights that most cyber compromises do not depend on sophisticated techniques; instead, threat actors frequently exploit known software vulnerabilities and basic security weaknesses. Drawing on CISA and open-source data from fiscal years 2024 and 2025, the review examines common software weaknesses and reinforces the importance of Secure by Design practices to prevent vulnerabilities at their source and reduce entire classes of security flaws.
The review outlines a risk based method for prioritizing vulnerability remediation. In alignment with Binding Operational Directive 26 04, organizations should evaluate vulnerabilities based on four factors: system exposure, inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog, potential for automated exploitation, and overall technical impact. This approach helps organizations direct limited resources toward the vulnerabilities that pose the highest risk.
Using CISA’s risk based vulnerability prioritization framework benefits the HPH Sector by helping organizations focus their limited cybersecurity resources on the vulnerabilities most likely to disrupt patient care. By evaluating exposure, KEV catalog status, potential for automated exploitation, and technical impact, HPH entities can more effectively identify which weaknesses pose the greatest threat to clinical operations, electronic health records, and critical medical devices. This targeted approach strengthens resilience, reduces the likelihood of high impact incidents, and supports continuity of care across the sector.