CISA Orders Agencies to Patch by Risk, Not Severity

New CISA directive tells federal agencies to patch by real-world risk, not CVSS severity scores