BOD 26-04 isn’t a scoring upgrade. It’s an audit of whether you can actually fix things. 

When automated threat actors weaponize vulnerabilities in hours, the ultimate bottleneck is not how fast we can scan, it’s how fast we can coordinate a fix.
http://news.poseidon-us.com/TV0hd4