Unpatched Systems Pose High Risk

Incidents caused by unpatched systems cost organizations 54% more than those caused by employee error, according to Tetra Defense.

The most common incidents, those with the root point of compromise (RPOC) linked to an externally facing vulnerability, are also the most expensive to recover from. The cost of an incident response engagement can vary wildly based on the size of the organization and scope of the incident response activities.

Typically, organizations don’t have the ability to test patching outside of their production environment, said Arctic Wolf’s Scott Holewinski.

“It is not uncommon for IT departments to delay patching in fear of impacting production, and business owners will often accept the risk that is associated with it,” he said. “Patching isn’t a one-and-done. It’s a task that requires constant maintenance and monitoring. Unfortunately, as IT and security teams are spread thin, patching often falls by the wayside. Patching is integral to protection against exploits. As soon as a proof of concept (PoC) is made public on the dark web or more legitimate forums like GitHub, most vendors will develop a patch. It’s critical to stay on top of guidance from industry organizations like (ISC)2 or federal authorities like the Cybersecurity and Infrastructure Security Agency (CISA) to prioritize the exploits that pose the highest risk to your organization.”