In 2017, the WannaCry ransomware affected over 200,000 organisations in 150 countries. The estimated damage amounts to 4 billion dollars. Yet a patch for the EternalBlue vulnerability (MS17-010), which WannaCry exploited, already existed. two months before the attack. Organisations that had applied the patch were not affected at all.
WannaCry is the best-known case, but certainly not an isolated one. Statistics repeatedly show the same thing: the vast majority of successful cyberattacks exploit known vulnerabilities for which a patch exists. The problem is not a lack of patches: the problem is their inconsistent application.
Why unsealed systems pose such a risk
Each software vulnerability receives a CVE (Common Vulnerabilities and Exposures) identifier upon disclosure and a CVSS (Common Vulnerability Scoring System) severity score on a scale of 0-10. A score of 9 or higher indicates a critical vulnerability - one that allows an attacker to remotely execute code without authentication, resulting in complete system takeover.
The problem lies in the time race. As soon as a CVE is published, several processes begin simultaneously:
- The security community analyses vulnerabilities and seeks countermeasures.
- The software manufacturer is developing and testing a patch.
- Attackers are developing an exploit - and they are often faster at it
A study by Ponemon Institute found that the average organisation applies critical patches within 60 to 150 days from their disclosure. Compared to the average of 15 days it takes attackers to create a working exploit, this represents a dangerous vulnerability window.
Zero-day versus n-day exploits
Zero-day It is a vulnerability for which no patch yet exists. They are rare, expensive and used primarily by state actors or sophisticated criminal groups. N-day maintenance Conversely, they target publicly known vulnerabilities for which patches exist, and these are responsible for the vast majority of real-world attacks. Companies that regularly apply patches are practically immune to N-day exploits.
How effective patch management works
Patch management is not just "running Windows Update." It is a structured process that includes inventory, prioritisation, testing and deployment of patches across the entire IT environment, including servers, network components, industrial systems and third parties.
Asset inventory: the foundation of everything
You cannot patch what you do not know about. The first step is a complete and up-to-date inventory of all software assets: operating systems, applications, network device firmware, middleware, and third-party libraries. Tools such as Qualys, Tenable.io, Microsoft Defender for Endpoint or the open-source OpenVAS enable automatic scanning and identification of installed software including versions.
In the real-world environment of a medium-sized company, the finding is often shocking: the IT department believed it managed 200 systems, but the actual inventory reveals 340, including forgotten servers, development environments and BYOD devices.
Patch prioritisation: what to patch first
Implementing everything immediately is not realistic. Prioritisation must be based on a combination of vulnerability severity and system exposure:
- Critical (CVSS 9-10): Repair within 24–72 hours. No exceptions.
- High (CVSS 7-8.9): Replacement within 7–14 days.
- Medium (CVSS 4-6.9): Patch within 30 days.
- Low (CVSS under 4): Patch within 90 days or at the next maintenance window.
A key factor not considered by the CVSS score itself is exposure contextA medium-severity vulnerability on a server exposed to the internet may be more urgent than a critical flaw in an isolated internal system. Modern vulnerability management platforms add context: is the vulnerability actively being exploited in the wild? Is there a public exploit available? Is the system accessible from the internet?
Testing prior to deployment
Patches themselves can cause problems, application outages, incompatibilities, broken dependencies. Therefore, it is necessary to test patches before deploying them to production:
- Test environment (sandbox) with a copy of the production environment
- Applying the patch to the pilot group
- Monitoring for a period of 24–72 hours
- Staged deployment to the rest of the environment
- Rollback plan in case of problems
In the case of critical patches where the risk of not patching significantly outweighs the risk of downtime, an accelerated procedure with a shorter testing period is adopted, but testing is never omitted entirely.
Automated vs. Manual patch management
Small companies with up to 50 devices can afford a manual approach using tools such as Windows Server Update Services (WSUS) or Intune. For larger organisations, manual patch management is unsustainable, too many systems, too many patches, too many exceptions.
Tools for automation
Commercial platforms for patch management (Patch My PC, ManageEngine Patch Manager Plus, Ivanti, Tanium) enable:
- Automatic scanning of vulnerabilities in real time
- Centralised patch management for all operating systems and third-party applications
- Planning window maintenance to minimise downtime
- Reporting and audit records for compliance
- Automatic deployment of patches with defined approval workflows
Automation dramatically shortens the time between patch release and application, thereby reducing the vulnerability window. However, this does not mean "set and forget." Patches must still be monitored, exceptions documented, and results reported to management.
Systems that cannot be easily patched
A special category comprises industrial control systems (OT/ICS), medical facilities and older legacy systems. Here, patching may be restricted by the manufacturer, certification requirements or the risk of downtime for critical processes. For these systems, compensating measures apply: network segmentation, anomaly monitoring and regular risk reassessment.
Effective patch management is not just a technical matter. It is an organisational process requiring clear accountability, resources and regular reporting to senior management. If you are unsure about the patch status in your organisation, SecureOn.cz team conducts a vulnerability assessment and helps set up the entire process from inventory to automated patch deployment.