Washington Eyes 72-Hour Cyber Defense Rule as AI Compresses Hacking Timelines From Weeks to Hours

U.S. cyber officials are considering a rule that would force federal civilian agencies to fix actively exploited software flaws within three days.

The proposed deadline would be far shorter than the current two-to-three-week patch window and is meant to counter AI-accelerated hacking.

CISA and other officials worry advanced AI could make attacks faster, more automated, and harder to defend against.

If adopted, the tougher federal standard could influence patching expectations for states, contractors, and critical infrastructure.