Of the top 10 problems organizations keep tripping over, the one I see most in the field is also the least glamorous: unpatched vulnerabilities. No zero-day wizardry required. Attackers exploit known flaws because they work.
The pattern repeats
Walk through almost any incident timeline and you find the same story. A public-facing system runs software with a published CVE. A patch existed for weeks, sometimes months. Nobody applied it. The attacker did the homework instead.
CISA maintains a Known Exploited Vulnerabilities Catalog precisely because actively exploited bugs keep showing up in breaches. The MITRE ATT&CK technique Exploit Public-Facing Application is one of the most common initial access vectors I document.
Why it keeps happening
It is rarely ignorance. It is friction:
- Asset blind spots. You cannot patch what you do not know you own.
- Uptime fear. Teams delay patches to avoid breaking production.
- Scale. Thousands of endpoints, dozens of vendors, no clear priority.
What actually helps
NIST SP 800-40 lays out solid guidance on enterprise patch management planning. The short version:
- Build and maintain an accurate asset inventory.
- Prioritize by exploitability, not just CVSS score. Check the KEV catalog first.
- Automate where you can. Manual patching does not scale.
- Track patch latency as a metric leadership sees.
Patching is boring. Getting breached over a six-month-old CVE is worse.