Vulnerability Management – Lessons Learned & Wisdom Earned

Drawing on eight years running GoSecure's Vulnerability Management as a Service, the presenter shares field lessons on getting patches deployed in organisations that believe it cannot be done. He sets the scene with the Patch Tuesday and Exploit Wednesday cycle, the growing technical debt of cumulative updates, and the point that most attacks pass through a correctable vulnerability; in his experience the average client starts near 6% compliance on critical patches. His method is incremental: choose scanning and deployment tools against real requirements, identify resistance points among understaffed teams early, start with a small low-risk slice of the estate and only the current month's patches, then chip away at backlog once a track record exists. He stresses benchmarking, realistic targets (80 to 88% already raises the attacker's cost), frequent reporting to leadership, and warning end users before mass deployments so the help desk is not flooded. A backlog chart illustrates the 'heartbeat' pattern of a mature programme, and he cautions against using scanners as the progress metric because of false positives and transient devices. He closes on cost: a programme is trivial next to a breach and pushes opportunistic attackers toward easier targets.