- Exploited software vulnerabilities now start more breaches than stolen passwords. The Verizon 2026 Data Breach Investigations Report puts the figure at 31% of breaches.
- You cannot patch what you do not know you have. An accurate asset inventory with a named owner for each system comes before any scanning tool.
- Prioritise by real-world risk, not CVSS score alone. A vulnerability on the CISA Known Exploited Vulnerabilities catalogue on an internet-facing device outranks a higher-scoring issue on an isolated internal server.
- Cyber Essentials requires critical and high-risk updates within 14 days of release. Under the Danzell question set used from 27 April 2026, missing that deadline on operating systems, firmware or applications is an automatic fail.
- When you cannot patch, mitigate, record the risk and set an expiry date. The NCSC is clear that deciding not to apply an update is a senior-level risk decision.
What vulnerability management covers
Patch management is the process of getting vendor updates onto your systems. Vulnerability management is wider. It covers finding weaknesses across everything you run, deciding which ones matter most, fixing or mitigating them within a set time, and proving that the fix worked. Missing patches are one type of vulnerability. Misconfigurations, default credentials, exposed management interfaces and unsupported software are others, and a patching tool will not find them.
Treat it as a continuous operational process with owners, targets and reporting, not a monthly IT task. The NCSC’s vulnerability management guidance sets the baseline: apply updates as soon as possible and ideally automatically, keep an inventory of your assets and who owns them, and have a specific process for vulnerabilities that attackers are already exploiting.
Why the window is shrinking
Attackers are getting faster and defenders are getting slower. The Verizon 2026 DBIR found that organisations fully remediated only 26% of the vulnerabilities on the CISA Known Exploited Vulnerabilities (KEV) catalogue, down from 38% the year before. The median time to fully patch rose from 32 to 43 days. Those are vulnerabilities with confirmed, active exploitation, and most stayed open for weeks.
At the same time, CrowdStrike’s 2026 Global Threat Report recorded that 42% of exploited vulnerabilities were used before public disclosure, and that 40% of the vulnerabilities exploited by China-nexus actors targeted internet-facing edge devices such as firewalls, VPNs and remote access gateways. AI is also speeding up vulnerability research on the attacking side, as our article on AI and incident response explains. A monthly patch cycle that takes six weeks to reach the last device leaves a long gap.
Faster patching only solves part of this. You also need to know where your exposure is, so that the vulnerabilities that matter get fixed first and the rest follow a predictable schedule.
The vulnerability management lifecycle
Most mature programmes follow the same six steps. Each one depends on the one before it, and gaps in the early steps undermine everything that follows.
Prioritising beyond CVSS
The Common Vulnerability Scoring System (CVSS) rates the technical severity of a vulnerability. It does not tell you whether anyone is exploiting it, or whether the affected system matters to your business. Sorting by CVSS alone sends teams chasing high scores on isolated systems while an actively exploited flaw on the VPN waits. Combine four signals.
Setting remediation targets
Remediation targets turn priorities into deadlines that people can be held to. The table below is a starting point we use with clients. Adjust it to your risk appetite and regulatory obligations, but keep the Cyber Essentials 14-day rule as a floor if you hold or plan to hold the certification.
| Tier | What qualifies | Suggested target |
|---|---|---|
| Emergency | On the CISA KEV catalogue or known to be actively exploited, on an internet-facing or business-critical system | Mitigate within 48 hours, fully fixed within 7 days |
| Critical / High | Vendor rates the issue critical or high, the CVSS v3 base score is 7 or above, or the vendor gives no severity | 14 days from release (the Cyber Essentials requirement) |
| Medium | CVSS 4.0 to 6.9 with no known exploitation | 30 days |
| Low | CVSS below 4.0, or findings that need significant access to exploit | 90 days, or the next scheduled cycle |
Measure the clock from the date the update is released or the vulnerability is published, not from the date your scanner found it. That matches how Cyber Essentials sets the deadline, and it stops slow scanning from hiding slow patching. Turn on automatic updates wherever the platform supports it. Cyber Essentials requires it where possible, and it removes most routine patching from the queue.
Edge devices and remote access
Firewalls, VPN concentrators, remote access gateways and other network appliances are the systems attackers most want to compromise and the ones organisations most often forget to update. They sit on the internet, they often run firmware that needs a manual update, and they rarely support endpoint security agents.
Give them their own process. Subscribe to the vendor’s security advisories and check them weekly. Make sure management interfaces are not reachable from the internet. Replace appliances that have reached end of support, because vendors stop releasing fixes for them. When a critical vulnerability is announced, patch first, then check for signs that the device was compromised before the patch. Attackers who exploited the flaw early may already have installed persistence that survives the update. Hardening guides such as the CIS Benchmarks help reduce the exposed surface in the first place.
When you cannot patch
Sometimes there is no fix yet, the fix breaks a critical application, or the system belongs to a supplier who controls the update. The NCSC guidance is direct: the decision not to apply an update is a senior-level risk decision, not one for an individual administrator to make alone.
Handle it as a formal exception. Apply compensating controls: isolate the system on its own network segment, restrict who and what can connect to it, disable the vulnerable feature, or add monitoring for exploitation attempts. Record the exception in your risk register with a named owner, the reason, the controls in place and an expiry date. Review it before it expires. An exception without an end date becomes a permanent gap that nobody remembers approving.
Unsupported software needs a plan of its own. Cyber Essentials requires all in-scope software to be licensed and supported, and unsupported software must be removed or moved into a separate sub-set with no internet access. Our article on Windows 10 end of life covers one of the most common current examples. Supplier-managed systems belong in your contracts too; our supply chain security guide covers how to set patching expectations for suppliers.
What the frameworks require
Most security frameworks that UK organisations work to include vulnerability management, with different levels of detail.
Security Update Management is one of the five technical controls in the Cyber Essentials requirements (v3.3). It covers servers, desktops, laptops, tablets, mobile phones, firewalls, routers and cloud services. All in-scope software must be licensed and supported, automatic updates must be enabled where possible, and updates must be applied within 14 days of release where the vendor rates the issue critical or high, the CVSS v3 score is 7 or above, or the vendor publishes no severity details. The NCSC recommends applying all updates within 14 days, though only the critical and high-risk ones are mandatory.
The Danzell question set, used for assessment accounts created from 27 April 2026, made the 14-day questions for operating systems, firmware and applications automatic fail points. Before that, a missed deadline could be marked as a non-compliance without failing the assessment outright. See our comparison of Cyber Essentials and ISO 27001 for how the two schemes fit together.
Annex A control 8.8, Management of technical vulnerabilities, requires you to obtain information about technical vulnerabilities, evaluate your exposure and take appropriate measures. Auditors expect to see a defined process, remediation timescales, evidence that you meet them, and a record of risk-accepted exceptions. Control 5.9 (inventory of information and other associated assets) supports it. Our ISO 27001 guide for SMEs covers the wider certification process.
Operators of essential services and relevant digital service providers are assessed against the NCSC Cyber Assessment Framework, where outcome B4.d covers vulnerability management. The Cyber Security and Resilience Bill, currently before Parliament, would bring managed service providers and data centres into scope, so more suppliers will need to show a working vulnerability management process.
NIS2 Article 21(2)(e) requires essential and important entities to cover security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure. If you make products with digital elements sold in the EU, the Cyber Resilience Act has required manufacturers to report actively exploited vulnerabilities since 11 September 2026, with the main security obligations following on 11 December 2027.
Metrics to report to the board
Boards do not need scan counts. They need to know whether the organisation is fixing the right things fast enough. Five measures cover most of it.
Known exploited vulnerabilities within target. The percentage of KEV-listed or actively exploited vulnerabilities fixed within your emergency deadline. This is the single most useful number.
Median time to remediate by tier. How long fixes actually take, compared with the targets in your policy.
Scan coverage. The percentage of assets in your inventory that were scanned in the last 30 days. Low coverage makes every other metric look better than it is.
Open exceptions. The number of risk-accepted vulnerabilities, how old they are, and how many have passed their expiry date.
Unsupported assets. The number of systems running software that no longer receives security updates, with a plan and a date for each.
Common mistakes
Scanning without an inventory. A scanner only checks what it is pointed at. Without an inventory to compare against, you cannot tell which assets it missed, and the missed ones are usually the least maintained.
Treating every high CVSS score as urgent. When everything is urgent, nothing is. Teams burn out working through thousands of findings in score order while the few that attackers are using wait their turn.
Forgetting firmware and third-party applications. Operating system updates are usually automated. Browser plugins, PDF readers, developer tools, network appliance firmware and line-of-business applications often are not, and they are where the gaps tend to sit. Endpoint management tools and Microsoft 365 and Intune policies can close much of this.
Trusting deployment reports. A patch marked as deployed is not a patch confirmed installed. Verify with a rescan.
Exceptions that never expire. Every accepted risk needs an owner, a review date and compensating controls. Otherwise the exception list quietly becomes the list of systems an attacker should try first.
Ryland has delivered cybersecurity, compliance, and IT management programmes for regulated organisations across the UK and the Netherlands for over 20 years. View full profile