The real cost of not patching
Dec 23rd, 2023 by Jesper Kråkhede
A final business post for 2023, and a topic I come back to every year: the cost of not patching.
This year was full of examples. A file transfer product exploited on a massive scale in early summer, with hundreds of organisations losing data, many of them without even knowing they used the product through a supplier. A remote access gateway vulnerability in the autumn that let attackers take over sessions and was used in serious ransomware attacks. In most cases, organisations that patched quickly were fine. Those who waited were not.
Why don´t organisations patch faster? Lack of resources, again. Not enough people to test and deploy patches, not enough maintenance windows, not enough knowledge of what is installed where. And fear that a patch will break something critical.
That fear is real. But compare the costs. A patch that breaks something usually means a few hours of trouble and a rollback. An exploited vulnerability can mean weeks of downtime, data loss, notifications to customers and regulators, and a damaged reputation.
So for management: ask how long it takes from a critical patch being released until it is installed on your internet facing systems. Ask what stops it from being faster. Then remove those obstacles, with money, people or automation.
Not patching isn´t free. It´s just a bill that hasn´t arrived yet. Well, well. Time for the traditional seasonal pizza with my now grownup kids.