This Week in Change Risk — Week of Jul 27, 2026
A CVSS 10.0 Arista SD-WAN flaw in KEV, a GitHub Copilot incident, Datadog's DASH launches, and the ECB's AI deadline — the week's change-risk signals.
The change-risk desk · Friday, July 31, 2026
RSS This Week's Live Risk Signals
Snapshot as of Jul 21Statically pre-rendered at build. The content-management cron refreshes this on a schedule (see roadmap).
- CISA KEVCISA KEV catalog last refreshed
Live feed wiring pending — placeholder card until cron ships.
- MSRCNext Patch Tuesday
Rolling 12-month calendar available in the free tool.
- AWS / Azure / GCP / Cloudflare / GitHubCloud provider status heatmap
Combined status board across the five providers change teams care about.
-
ServiceNow AI Change Risk Assessment: What CABs Must Verify
ServiceNow's July 2026 patch auto-fills change risk assessments with AI. What the four risk mechanisms actually do, and what your CAB still has to own.
-
The 12 External Risk Sources Every CAB Should Monitor
The 12 external feeds — CISA KEV, Patch Tuesday, cloud status pages, NVD, and more — a CAB should track before approving changes.
-
The change-window scheduling problem, and how teams actually solve it
Change window scheduling means balancing low-risk timing against staffing and burnout. Here's how CAB teams, tools, and policy actually resolve it.
-
CISA BOD 26-04: Risk-Based Patch Deadlines for CABs
CISA BOD 26-04 replaces the flat 14-day KEV clock with 3, 14, and 60-day risk-based deadlines. What change managers and CABs must rebuild by December.
-
DORA Change Management Checklist for Resilience Teams
What DORA requires from IT change managers: Articles 9, 12, 17, and 24-27 mapped to a practical CAB checklist, plus a 90-day compliance plan.
-
SOX Change Control Checklist Mapped to Your ITSM Workflow
What SOX §404 and ITGC actually require for IT change control, mapped field-by-field to ServiceNow and Jira Service Management tickets.
-
This Week in Change Risk — Week of Jul 27, 2026
A CVSS 10.0 Arista SD-WAN flaw in KEV, a GitHub Copilot incident, Datadog's DASH launches, and the ECB's AI deadline — the week's change-risk signals.
-
This Week in Change Risk — Week of Jul 20, 2026
KEV batch of 6, a GitHub Actions outage, Datadog's AI incident tooling, and the NIS2 deadline confusion — the week's change-risk signals for CABs.
-
CISA's July 21 KEV Batch: How a CAB Should Triage 4 CVEs
CISA added four exploited CVEs on July 21, 2026 — WordPress, Langflow, and DD-WRT. A change manager's triage playbook under the new BOD 26-04 rules.
-
Azure West US Outage: When a Maintenance Change Breaks a Region
A maintenance-automation bug cut Azure West US for 5 hours on July 23. A change manager's breakdown of the failure and the CAB controls that catch it.
-
Provider-of-Provider Risk: When Your PaaS's Cloud Fails
Railway's 8-hour outage began when Google Cloud suspended its account. A change manager's guide to fourth-party dependency risk and CAB controls.
-
AWS us-east-1 Outage History: A 5-Year Timeline
Every confirmed AWS us-east-1 outage since 2021, sourced from AWS's own post-event summaries, with root causes and what changed.
-
Status Page Aggregators Compared: StatusGator vs IsDown
StatusGator vs IsDown vs IncidentHub for change-risk early warning: catalog size, pricing, alerting, and where each aggregator falls short for a CAB.
-
Best Change Management Software for Regulated Industries 2026
10 ITSM vendors compared on FedRAMP, SOC 2, SoD, CAB, and data residency for SOX, HIPAA, PCI DSS, and DORA-scoped buyers.
-
ServiceNow vs Jira Service Management for Change (2026)
ServiceNow vs Jira Service Management change management compared: risk scoring, CAB tools, CMDB vs Assets, pricing, and which fits your org.