Bitsight renamed the Patching Cadence risk vector to Critical Vulnerability Management as of July 16, 2026 and updated how the risk vector calculates grades.
This article describes what changed, how the new version calculates grades, and how the change may affect your grade in the Bitsight Security Rating.
Applies to: Organizations that use the Patching Cadence risk vector in their Bitsight Security Rating.
What changed?
The Patching Cadence risk vector is now Critical Vulnerability Management. The new version also changes how severity and duration affect the grade. It tracks the same set of vulnerabilities as Patching Cadence did. The change affects how much each vulnerability lowers the grade, not which vulnerabilities are tracked. Bitsight made this change to better reflect how quickly severe vulnerabilities are patched.
The most important changes in this new version are:
Critical Vulnerability Management includes these changes to how it calculates grades:
- The Common Vulnerability Scoring System (CVSS) score of a vulnerability also affects the grade, and it is the most influential factor. High CVSS scores, such as 9.0 or 10.0, have the greatest influence.
- The average time that a known vulnerability remains unpatched in your organization still affects the grade, but its effect is smaller than in Patching Cadence. Vulnerabilities that remain unpatched for extended periods, such as hundreds of days, lower the grade more significantly.
- Critical Vulnerability Management uses a logarithmic scale. The scale gives high-severity vulnerabilities that remain unpatched for a long time a significant effect on the rating.
What does Critical Vulnerability Management measure?
Critical Vulnerability Management measures absolute risk:
- A high grade indicates strong patching performance, especially for critical vulnerabilities.
- A low grade indicates that severe, long-standing vulnerabilities remain unpatched. These vulnerabilities pose significant risk and need urgent attention.
- The grade measures the severity and duration of vulnerabilities, not the size of the organization. Large organizations with good patching practices can still achieve high grades.
How do severity and duration affect the grade drop?
Each unpatched vulnerability lowers the Critical Vulnerability Management grade by an amount that depends on two factors:
- its CVSS score, which measures severity
- how long it has remained unpatched, which measures duration.
The table in this section shows the grade for each combination. Green indicates a smaller drop, and red indicates a larger one.
FAQ
1. Are the set of tracked vulnerabilities included in Patching Cadence going to change?
No. Critical Vulnerability Management tracks the same set of vulnerabilities as Patching Cadence. The change affects how the severity and duration of unpatched vulnerabilities affect the grade.
2. Can Patching Cadence and Critical Vulnerability Management both appear in my rating?
No. Patching Cadence remained in the Bitsight Security Rating only until Critical Vulnerability Management is released. After release, only Critical Vulnerability Management appears in the rating, and Bitsight retires Patching Cadence. The two versions do not appear in the rating at the same time.
3. Why is the CVSS score now the most important factor?
The CVSS score represents the inherent risk of a vulnerability. Weighting the grade more heavily toward severity directs attention to the vulnerabilities that pose the greatest risk.
4. How does this affect my Bitsight rating?
Your organization may see changes in risk vector grades, in your Bitsight Security Rating, or in both. The change depends on how quickly your organization patches high-severity vulnerabilities. If you patch critical vulnerabilities quickly, your grade may increase. If high-risk vulnerabilities remain unpatched for a long time, your grade may decrease.
5. Will the new model penalize larger organizations more?
No. Like Patching Cadence, Critical Vulnerability Management does not depend on organization size. It evaluates how well vulnerabilities are patched, not how many vulnerabilities exist. A large organization with disciplined vulnerability management can still achieve a high grade.
6. Will historical patching performance be reset?
No. Critical Vulnerability Management still considers how long each vulnerability remained unpatched, so past delays continue to affect the grade. Improvements in current patching behavior raise the grade over time.
7. What should we focus on to improve our grade?
- Prioritize patching vulnerabilities with high CVSS scores
- Reduce the average time to remediation. Vulnerabilities that have remained unpatched the longest can strongly affect that average, so addressing them can help.
- Use a structured vulnerability management process to track and remediate vulnerabilities.
8. Will Critical Vulnerability Management be included in the Risk Remediation Plan?
Yes. Bitsight plans to add Critical Vulnerability Management to the Risk Remediation Plan before it is included in the rating. Until then, the Risk Vector Preview page shows how the upcoming update could affect your grade.
- July 16, 2026: Patching Cadence has been renamed to Critical Vulnerability Management and has updated its methodology per RAU26.
- January 6, 2026: Published.
Comments
Please sign in to leave a comment.