Continuous Monitoring Overhaul: Risk-Based VM and BOD 26-04

FedRAMP Notice 0014 shifts to risk-based vulnerability management, retiring monthly scans in favor of VDR/VER. BOD 26-04 mandates 3-day critical vuln patching. Active exploits (PAN-OS, Cisco SD-WAN) and NTC-0016 failures (10 providers) underscore urgency. New tools like Qualys InstaScan and RapidFort Runtime address speed requirements. Lazarus Alliance benchmark report provides concrete data on assessment duration (42 days median) and common control failures, reinforcing the need for living SSPs and structured evidence. New article 'Why AI Pushes Vulnerability Management Beyond CVEs' offers practical framework for exploitability-based prioritization and attack path analysis, aligning with the risk-based VM shift.