A new report from the Ponemon Institute and ServiceNow titled, Today’s State of Vulnerability Response: Patch Work Demands Attention, highlights the need for better patch management practices. According to the study, in the past two years, 48% of companies have experienced a data breach.
Even more troubling than the number of companies that have experienced a breach is the reason why. Per the report, “Fully 57% of respondents who reported a breach said that they were breached due to a vulnerability for which a patch was available but not applied. 34% say they actually knew they were vulnerable before the breach occurred.”
If this type of behavior continues, we’ll see even more companies making headlines. Per the report, respondents have seen a 15% increase in cyberattack volumes over the last 12 months, and a 23% increase in cyberattack severity over the last 12 months. More than half have also seen an increase in the speed of attacks. The time between a patch release and an attack has sped up by 29% in the last two years.
The report highlights two factors that showed up between companies that haven’t been breached and those that have. “Companies that avoided breaches rated their ability to patch vulnerabilities in a timely manner 41% higher than those that had been breached, and they rated their ability to detect vulnerabilities 19% higher. Patching is the most significant characteristic of companies that were not breached in the last two years.”
As we’ve mentioned before, you can’t patch what you can’t see. Visibility of your infrastructure is critical to reduce this attack vector. Simply knowing what patches you need can reduce your risk of being breached by 20%.
Beyond visibility into their patch status, the other limitation respondents face is a manual patching process. 61% admit that manual processes put them at a disadvantage, and 55% note that they spend more time dealing with internal processes than managing the vulnerabilities.
More than 12 days are lost coordinating between teams to get patches applied. Reasons include:
- 73% have no common view of assets and applications across security and IT
- 57% admit that patches slip through the cracks due to emails and spreadsheets used to manage the process
- 62% have no easy way to track whether vulnerabilities of being patched in a timely manner
- 65% say they find it difficult to prioritize what needs to be patched first
The study also mentions a ‘patching paradox’, whereby the idea of hiring more people will improve security hygiene. Though in reality it doesn’t. 64% of companies are planning to hire more dedicated people to handle vulnerabilities, accounting for a 50% increase in headcount.
“While security teams plan to hire more staffing resources for vulnerability response – and may need to do so—they won’t improve their security posture if they don’t fix broken patching processes. The study shows that firms struggle with patching because they use manual processes and can’t prioritize what needs to be patched first.”
All of this points to cloud-native automation as the answer. Automox provides you with visibility of your infrastructure, including your remote endpoints. And displays the current patch status of every endpoint with patch severity ratings so you can prioritize which patches to deploy first. Finally Automox automates your patch remediation so you don’t lose valuable time between patch release and application.
About Automox
Facing growing threats and a rapidly expanding attack surface, understaffed and alert-fatigued organizations need more efficient ways to eliminate their exposure to vulnerabilities. Automox is a modern cyber hygiene platform that closes the aperture of attack by more than 80% with just half the effort of traditional solutions.
Cloud-native and globally available, Automox enforces OS & third-party patch management, security configurations, and custom scripting across Windows, Mac, and Linux from a single intuitive console. IT and SecOps can quickly gain control and share visibility of on-prem, remote and virtual endpoints without the need to deploy costly infrastructure.
Experience modern, cloud-native patch management today with a 15-day free trial of Automox and start recapturing more than half the time you're currently spending on managing your attack surface. Automox dramatically reduces corporate risk while raising operational efficiency to deliver best-in-class security outcomes, faster and with fewer resources.
