Most compromises still come down to basic security failures

On 26 August 2026 CISA published the CISA Vulnerability Review, covering fiscal years 2024 and 2025. The review draws on CISA's own data alongside open sources. Its central message is that most compromises rest on basic security failures rather than on advanced techniques. CISA points to improper input validation and memory safety weaknesses as the most reliable entry points for threat actors. Poor patching and continued use of end-of-support technology are singled out as significant contributors to successful attacks.

What this means for you if you prioritise vulnerabilities

This report gives you nothing new to fear. It gives you something to point at. In our experience the hard part of basic security work is not knowing what to do, but winning the argument for spending time on it. When CISA states that most compromises come down to failures in the simple things, that is an argument you can carry into the budget conversation.

The second thing you can use is the framework the report points to. CISA recommends prioritising on four questions: whether the asset is exposed, whether the vulnerability sits in the Known Exploited Vulnerabilities catalogue, whether exploitation can be automated, and what the technical impact would be. You can apply that order without being a US federal agency. If you currently sort by severity alone, this is a better set of questions. CISA also frames the review as a baseline, measured before tools that find vulnerabilities automatically become more widespread.

Berigo recommends

• Measure how long it actually takes from a fix existing to it being installed in your estate. That number is the report's real subject.
• Build an inventory of what you run that is out of support, and put a date against each item.
• Prioritise on exposure, known exploitation, potential for automation and technical impact, rather than on severity alone.
• Require input validation and memory safety in procurement. That is where the report points.
• Use the report as an appendix when basic security work has to be justified to leadership.