The cost of patching versus not patching
Mar 24th, 2021 by Jesper Kråkhede
Following up on my short post, let´s talk about the money side of patching.
Patching costs. It needs people, tools, test environments and maintenance windows when systems are down. For some legacy systems it means paying for extended support or rebuilding applications. I understand why it is tempting to postpone.
But look at the other side. Since I started working in incident response I have seen very few incidents where the attacker used something truly unknown. Almost always it was a known vulnerability with a patch available, sometimes for years. Just a few weeks ago the world scrambled to patch Exchange servers after a set of vulnerabilities was exploited on a massive scale. The ones who patched in the first days were in a much better position than those who waited for the next maintenance window.
Here is a simple way for management to look at it. Ask your IT department what it costs per year to keep everything patched within 30 days. Then ask what one week of complete downtime would cost the business. In every company I have asked, the second number is many times bigger than the first.
And patching is one of the few security investments where the effect is easy to measure: the share of systems patched on time.
Patching is not an IT cost. It is the cheapest insurance you can buy.