Photo credit: venturebeat.com
This article is part of VentureBeat’s special issue, “The cyber resilience playbook: Navigating the new era of threats.” Read more from this special issue here.
The act of delaying critical software updates has proven to be more detrimental to corporate networks than any state-of-the-art cyberattack or hidden zero-day exploit.
A culture of complacency can be costly. Whether it involves using outdated patches or neglecting patching altogether, these oversights are often how ransomware infiltrates systems, leading to data breaches and subsequent penalties for non-compliance. For organizations, it is more a question of “when” they will face a breach than “if,” especially if they fail to prioritize effective patch management.
Why so many security teams procrastinate – and pay a high price
In many organizations, patching is regarded as a mundane task often assigned to junior staff or those tasked with less engaging responsibilities. The reluctance to engage in patch management stems from its repetitive nature and the thorough focus it demands.
Confidential insights from numerous security and IT professionals who spoke with VentureBeat reveal that many deem the patching process overly time-consuming, preferring to allocate their energy to more stimulating work. This perspective aligns with findings from a recent study by Ivanti, which indicated that 71% of IT and security personnel find patching to be complex and burdensome.
With the growing prevalence of remote working arrangements, 57% of security experts have acknowledged that managing patches has become increasingly challenging. Furthermore, Ivanti’s research highlights that 62% of IT leaders admit that tasks like patch management are often deprioritized in favor of more urgent responsibilities.
Unfortunately, many organizations have fallen behind regarding device inventory and manual patch management practices. In contrast, cyber adversaries continue to enhance their skill sets, employing sophisticated tools such as weaponized large language models (LLMs).
Not patching? It’s like taking the lock off your front door
Recent crime trends illustrate a troubling reality: affluent neighborhoods equipped with high-security measures are being targeted as criminals leverage advanced surveillance technologies. The ease with which perpetrators can exploit security lapses reveals the dangers associated with negligence.
This analogy holds for organizations that refrain from implementing timely patches. Tasks that are consistently set aside may never receive adequate attention. As cybercriminals become more adept at exploiting widely known vulnerabilities, the risk of becoming a target increases substantially.
Research from Gartner consistently emphasizes the importance of patch management as a facet of vulnerability management. In a recent study, Gartner identified critical elements for effective vulnerability management and discussed the implications of poorly handled patching exceptions, which can result in a heightened risk profile for organizations.
This mismanagement often arises when security teams consider manual efforts to be sufficient, leading to exploitable vulnerabilities within systems. Given the rapid pace at which threats evolve, the traditional approach of “scan, patch, rescan” fails to address the sophistication of contemporary cyber threats effectively.
The GigaOm Radar report provides further insight, detailing the significant challenges associated with patch management and indicating that many vendors struggle to achieve uniformity in software patches, device drivers, and firmware updates.
Why traditional patch management fails in today’s threat landscape
Typically, most organizations follow a scheduled patching cycle based on the static Common Vulnerability Scoring System (CVSS) severity ratings. However, adversaries have evolved beyond this static framework and can create more intricate threats that CVSS scores may not be able to adequately capture.
As Karl Triebes, Chief Product Officer at Ivanti, points out, “Relying solely on severity ratings and a fixed monthly cycle exposes organizations to unaccounted risk.” Failure to consider unique organizational contexts and evolving threats may prevent companies from effectively addressing their risk profiles.
The framework established by Gartner advocates for implementing “advanced prioritization techniques” and automated workflows that take into account both asset importance and current threat landscapes. This focus on proactive rather than reactive measures is echoed in GigaOm’s report, which stresses the need for comprehensive patching that goes beyond mere operating system updates.
Risk-based and continuous patch management: A smarter approach
Chris Goettl, Ivanti’s VP of Product Management for Endpoint Security, elaborates that enhanced patch prioritization should factor in elements like active exploitation trends, threat intelligence, and the criticality of assets. This fluid approach is better suited for responding to risks in real-time, offering a significant improvement over static scoring systems.
Triebes reinforces this notion, emphasizing that outdated reliance on severity ratings heightens organizational vulnerabilities. Nevertheless, prioritization alone is insufficient in combating modern cyber threats.
Cyber attackers can leverage vulnerabilities within hours, and advancements in generative AI have made their methods even more effective. Organizations that depend on infrequent patching schedules are unable to keep pace with evolving cyberattack strategies.
Utilizing machine learning-based patch management systems allows organizations to prioritize updates according to current threats, ensuring compliance with various regulatory standards. Automation powered by AI also plays a crucial role in closing the gap between vulnerability detection and remediation.
According to Gartner, sticking to manual processes creates “bottlenecks that delay the response to zero-day vulnerabilities, resulting in lower-priority patches overshadowing urgent vulnerabilities.” Consequently, organizations must transition to continuous automated patch management to maintain growth and security.
Choosing the right patch management solution
Integrating generative AI with traditional machine learning algorithms can significantly enhance the efficiency of modern patch management systems. Most vendors in the space have integrated these technologies into their future plans.
The GigaOm Radar for Patch Management provides an in-depth assessment of various patch management providers, evaluating the strengths and weaknesses across the market, including notable players such as Atera, Automox, and Ivanti.
The GigaOm Radar visually represents vendor solutions, categorizing them by maturity and innovation while projecting their developmental trajectories over the next year to 18 months.
Gartner recommends that organizations leverage risk-based prioritization alongside automated workflows to expedite the patch process. The effective patching strategy should encompass the following:
- Strategic deployment and automation: Map critical assets and reduce human error through AI-driven approaches.
- Risk-based prioritization: Target actively exploited vulnerabilities.
- Centralized management and continuous monitoring: Consolidate efforts to achieve real-time security visibility.
By adhering to these principles, organizations can alleviate workloads for their teams and enhance their overall cyber resilience.
Automating patch management: Measuring success in real time
All market competitors have achieved foundational performance and functionality in streamlining patch validation, deployment, and testing. By connecting patch data with actual exploit activities, vendors are effectively reducing the mean time to remediation (MTTR).
Measuring progress is crucial, and Gartner identifies essential metrics to track:
- Mean-time-to-patch (MTTP): Average time taken to remediate vulnerabilities.
- Patch coverage percentage: Ratio of patched assets versus those that are vulnerable.
- Exploit window reduction: Time lapse from vulnerability disclosure until remediation.
- Risk reduction impact: Number of actively exploited vulnerabilities patched prior to incidents.
Automate patch management — or fall behind
Patching should not be viewed merely as an afterthought once higher-priority projects are completed. Instead, it is fundamental to sustaining organizational security and resilience against potential threats.
Patching is integral to maintaining cyber resilience; however, many organizations continue to undermine its importance, leaving known vulnerabilities exposed to the risks posed by technologically advanced adversaries. The static nature of CVSS scoring systems is no longer adequate, and rigid cycles have increasingly become liabilities rather than safeguards.
The takeaway is clear: complacency regarding patch management poses significant risks—now is the time to prioritize this essential practice.
Source
venturebeat.com