The past few weeks have seen a flurry of action from the White House, including the signing of the Executive Order “Promoting Advanced Artificial Intelligence Innovation and Security” and the accompanying National Security Presidential Memorandum, “Artificial Intelligence in the National Security Enterprise” (NSPM-11). Most of the commentary in Washington, D.C. and beyond has focused on the assessment of frontier AI model governance. However, for enterprise security leaders, there is a significant second storyline that is getting less focus – empowering cyber defenders to prioritize and buy down risk.
The Administration is leveraging this moment to nudge the federal government and its partners from static compliance checklists to regimes that provide modern risk assessment frameworks, focusing resources on assessing and eliminating key threats to federal systems.
Modernizing Federal Remediation
The President’s Executive Order places an immediate, 30-day mandate on the Department of War and Civilian Federal Agencies to prioritize cyber defense against AI risks.
The Cybersecurity and Infrastructure Security Agency (CISA) has already taken a key early action by issuing Binding Operational Directive (BOD) 26-04, “Prioritizing Security Updates Based on Risk,” on June 10, 2026. Citing the Executive Order, the directive establishes prioritized remediation timelines for federal agencies based on the risk from a vulnerability to the specific environment. Federal agencies are now required to consider several factors, including whether the vulnerability is being actively exploited in the wild, its internet exposure, and potential impact on systems.
Context-based prioritization marks a major shift from previous requirements. It replaced two directives (BOD 22-01 and BOD 19–02) that required asset discovery every week and vulnerability enumeration every two weeks, followed by remediation timelines of 15 and 30 days for most critical and high vulnerabilities. This meant significant vulnerabilities could go a month or more without remediation. BOD 26-04’s focus on context-based prioritization marks a major shift from relying on CVSS severity scores to an exploit-evidence model that mandates remediation of the highest-risk vulnerabilities in as little as three calendar days.
Nuanced prioritization has become a north star for cybersecurity professionals in the private sector over the last few years as the cybersecurity community grapples with increasingly rapid exploitation of vulnerabilities. It is also a bedrock element of how Wiz helps its customers manage risk within their environment.
This change is a recognition by the federal government that we are entering an era where AI is able to weaponize vulnerabilities in hours, and exploitation techniques are automated to immediate and wide effect. In this world, uniform compliance-based approaches to patching cannot scale to meet the threat. Wiz has been actively engaging with government officials on how to shift the government toward a more priority-driven remediation approach. This new framework from CISA takes a major step forward in that direction.
These presidential actions also task the Department of War and National Security Agency with meeting this moment, taking new approaches to hardening our national security systems against emerging AI-driven threats, accelerating the adoption of AI-enabled defensive tools and fostering voluntary public-private partnerships to build a more resilient cybersecurity ecosystem.
A key determinant in how effective the federal government will be at meeting the moment is how risk is measured and new vulnerabilities are prioritized. For example, some agencies will assume exploitation of a vulnerability will only have limited impact on a critical system based on external guidance such as a CVSS score or threat intelligence. But external guidance is only part of the story: a real understanding of where a vulnerability sits in relation to other dependencies in an environment–such as sensitive data, certain configurations, and escalated privileges–is the true story of that vulnerability’s impact. Modern capabilities will allow federal agencies to quickly and continuously automate this broader context-driven assessment.
Leveraging AI-Enabled Technologies
Federal agencies will also be expected to rapidly expand the use of AI-enabled defensive tools to keep pace with these threats. For many, this will be seen as an opportunity to introduce unique frontier models to find exploits in source code. While that will be a boon to supporting more secure code as it is developed, we need to remember that finding unique zero day vulnerabilities in existing code was never the biggest problem of cyber defenders. Rather, identifying and closing existing vulnerabilities has been the consistent challenge.
Applying AI to assist defenders in approaching this day-to-day problem of more vulnerabilities, more complexity, and the need to move rapidly against increasingly automated attempts at exploitation will be key as mean-time-to-exploit (MTTE) continues to decrease.
At Wiz, our approach has been to augment ground-truth data and context with AI-accelerated discovery and analytics. This approach has been helping our customers continuously scan external exposures to uncover complex application-layer weaknesses and validate what is truly exploitable rather than just reachable.
This approach is also supporting security teams in moving away from manual alert review toward automated response workflows. By utilizing deep context from code-to-cloud with AI-accelerated investigations, organizations can quickly detect suspicious behavior, evaluate the blast radius, and contain threats at machine speed before they cause business impact.
Finally, remediation in large or complex environments is traditionally a taxing process, taking time and testing. Leveraging AI-driven insights, security teams can automatically route issues to the right owners and determine the fastest, safest remediation paths to drive down mean-time-to-remediate timelines.
These tools are widely available for modern cybersecurity organizations today, and will keep improving in their competency in the coming months and years ahead.
New Expectations for Federal Partners
Most cloud and software providers that support federal systems are ultimately going to be responsible for aligning with these requirements. Under CISA’s BOD, civilian agencies are required to review all existing contracts and consult with Contracting Officers to make necessary modifications to ensure compliance with the directive's actions.
CISA is recommending that agencies embed the Directive's remediation timelines directly into service level agreements and contractual arrangements. For cloud services, the expectation is required actions under the BOD align with the shared responsibility model between the agency and the cloud service provider. The national security memoranda will also spur new requirements for private sector contractors supporting systems for national security systems.
For many, this will come as a welcome opportunity to more closely align with practices they use with their private sector clients, shifting more resources towards the most significant risks in their environment. For others, there will be a need to modernize how they assess their environments and adapt to this more fast-paced and nuanced approach to defense.
The Executive Order also renews the call for companies and individuals to assist in building the U.S. Tech Force program, which is focused on solving “the most complex and large-scale civic and defense challenges of our era.” Wiz is proud to partner with the U.S. Office of Personnel Management on this initiative.
State, Local and Critical Infrastructure Partners
For state, local and critical infrastructure providers, the AI Executive Order provides another commitment from the federal government to provide support for their cyber resiliency. The EO facilitates access to cybersecurity tools and services to state and local governments, as well as operators of critical infrastructure ranging from hospitals and local utilities to community banks.
The wide availability of AI is making average attackers more sophisticated, and giving well-known threat actors new opportunities for scale and efficiency of operations. In the face of these escalating threats, governments, hospitals, and utilities stand out as significant targets with limited resources to identify and mitigate risk.
From New York to Ohio to Texas, we are seeing state governments play an active role in helping improve cyber resiliency and respond to threats against local infrastructure. While states and local governments previously had an infusion of resources to support this activity through the federal State and Local Cybersecurity Grant Program, the future of that program is unclear. Last month, state leaders testified before the House Homeland Security Committee on how crucial this program has been in improving resiliency, and Wiz has been a supporter of the passage of the “Protecting Information by Local Leaders for Agency Resilience Act” (PILLAR Act), to reauthorize and enhance the grant program for seven years.
Passage of the PILLAR Act and a reinvigoration of the State and Local Cybersecurity Grant Program is only a first step in building a more resilient cyber ecosystem at all levels. Active collaboration and partnership between federal cybersecurity authorities and critical infrastructure providers around the country will be necessary to build a process for supporting the rapid identification of weaknesses that create a significant opportunity to harm U.S. national and economic security, as well as the safety of American citizens.
Hardening Next-Generation Computing Facilities Against Tampering
NSPM-11 places a focus on the digital and physical infrastructure hosting advanced AI systems for national security use cases. It outlines a new framework for building out next-generation, high-security computing facilities capable of running massive workloads at scale. As one would expect with a national security system, it seeks “appropriate high security requirements” and zero-tolerance for tampering, directing agencies to ensure foreign actors cannot disable, degrade, or modify these networks.
It is exciting to see the White House note the reality that an AI model is only as secure as the infrastructure it lives in. Threat intelligence leaders have already shown that threat actors aren't spending their time trying to manipulate a model's function in isolation; they are targeting the structural technology surrounding it—the Kubernetes clusters, the cloud control planes, and the massive training data repositories feeding the pipeline. This is why Google created the Secure AI Framework (SAIF): bolstering the architecture to guarantee that AI implementations maintain a secure-by-default posture.
A high profile example of a significant weakness in the complex digital infrastructure that surrounds AI was a publicly accessible database belonging to the AI company DeepSeek. The exposure, which was identified by the Wiz Research team, allowed full control over database operations, including the ability to access over a million lines of log streams containing chat history, secret keys, backend details, and other highly sensitive information. This is just one display of how the rapid adoption of AI services without corresponding security often emanates from the flaws in the components and tools supporting them.
Because of this tactical shift, the Cloud-Native Application Protection Platform (CNAPP) and AI Application Protection Platforms become core elements of security architecture. Securing next-generation facilities requires a continuous, real-time mapping of the entire ecosystem. Platforms like Wiz are built specifically to track these complex, cross-domain attack paths—like overly permissive identity entitlements, embedded keys, and training datasets across multi-system integrations. Wiz allows security teams to eliminate infrastructure risks before an adversary can weaponize them, providing the assurances sought in NSPM-11.
Managing the Operational Friction of Multi-Vendor Mandates
The memorandum also forces a tight 120-day timeline for national security agencies to update procurement processes to support multi-vendor onboarding. The policy objective is clear: eliminate single-vendor lock-in and ensure the public sector can rapidly deploy the best commercial and open-source models available simultaneously.
This flexibility introduces operational complexity for enterprise defenders. Pulling models from different providers across distinct cloud environments multiplies the attack surface exponentially, leaving legacy, siloed security tools and basic cloud-native point solutions completely outmatched.
Managing this multi-vendor landscape requires a fundamental pivot toward graph-based security models that centralize risk data and democratize action across the enterprise. Instead of forcing security teams to manually parse fragmented data across disparate cloud environments, the modern standard ensures threat data is contextualized across AWS, Azure, GCP, OCI, and specialized AI pipelines simultaneously. This is the only way an enterprise's defensive posture can scale at the same velocity as complex AI deployments. It allows organizations to eliminate blind spots, and quickly identify the weaknesses and misconfigurations that fragmented environments naturally create.
Looking Ahead
The “Promoting Advanced Artificial Intelligence Innovation and Security” Executive Order represents a vital maturation point in our national cyber strategy. Wiz is incredibly proud to be supporting agencies on this journey, whether as a partner in the expansion of the United States Tech Force helping to scale the cyber talent needed to defend our nation or providing visibility into prioritized risk for some of the U.S. Government’s largest agencies.
The critical operational risk to most organizations today is still common flaws and misconfigurations, along with the rapid proliferation of "Shadow AI"—well-meaning developers and data scientists spinning up unauthorized AI pipelines, accidentally exposing model registries to the public internet, or hardcoding active keys into code repositories just to bypass internal friction and get a project moving faster.
Now is the time to prepare. Bridging corporate governance gaps and federated cybersecurity structures without halting developer velocity means tackling the basics of visibility, accelerating vulnerability and patch workflows, and aggressively reducing attack surface. Long term, we must achieve a shared vision of combining deep visibility, threat intelligence and agentic defense support that ensures that data pipelines are systematically protected and misconfigurations are remediated before code ever hits production, converting security into an active catalyst for safe AI adoption rather than an inhibitor.
The shift to AI-driven security is not a future discipline—it is a present-day necessity. By partnering together, embracing continuous AI-powered security, and focusing on actual risk context, the public and private sectors can ensure that we maintain our technological dominance while keeping our critical infrastructure secure.
