Hot Take: Stop Asking If You're Patched. Ask What AttackersAre Using.
A report that says 98% patched can still hide the one flawthat matters. Here are the questions to ask your IT team instead.
Executive Summary
· Most owners hear about patching as one number,like percent patched. That number does not tell you whether you are safe.
· Severity scores rate how bad a flaw could be intheory, not whether attackers are using it. A free government list tracks theflaws in active use, and it should set the order of work.
· Ask your IT team three questions: Do we haveanything on that list? Can it be reached from the internet? How fast do we fixthose?
A Clean Report Can Still Leave the Door Open
Picture the monthly IT report: 98% of systems patched,critical findings down from 60 to 40, green arrows everywhere. But the reportusually answers the wrong question. It measures how much work got done, notwhether the flaws attackers are using got closed first.
Order matters more than volume. Verizon's 2026 Data BreachInvestigations Report found that exploiting software flaws is now the mostcommon way attackers break in, ahead of stolen passwords. Among small andmedium-sized businesses in that data, it was the way in for 26% of breaches.Fixes are also getting slower. Of the critical flaws on the government'sknown-exploited list, organizations in Verizon's data fully fixed only 26%, andthe median time to a full fix stretched to 43 days.
Google's Threat Intelligence Group adds a worrying detail.In its latest yearly review of flaws exploited before any fix existed, 48% hitbusiness-grade technology, and about half of those were in security andnetworking gear. The firewall and remote-access box at the edge of your networkare prime targets. Attackers scan the internet for these flaws automatically,so being small is no shield.
Three Questions for Your IT Team
Every flaw gets a severity score from 0 to 10. It describesthe worst case, not whether anyone is exploiting it or whether your system iseven reachable. A 9.8 on a machine nobody can reach can wait. A 7.5 on yourfirewall that attackers are using this week cannot. Ask better questions:
1. Do we have anything on CISA's Known ExploitedVulnerabilities list? It is a free public catalog of flaws attackers areconfirmed to be using. If nobody checks it, that is your first gap.
2. Which of those can be reached from the internet?Firewalls, VPNs, remote access tools, and websites come first. They are thefront door.
3. How fast do we fix them, and what happens whenwe can't? Agree on a clock: known-exploited and internet-facing gets fixed indays, not at the next monthly cycle. If no fix is ready, ask what is being doneinstead, like turning the feature off.
Then change the report. Put one line at the top:known-exploited flaws open today, and how long each has been open. When thatnumber is zero, the green arrows mean something.
The Takeaway
A high patch rate is not the goal. Quickly closing the flawsattackers are using is. Ask the three questions this month, and makeknown-exploited flaws the first line of every IT report.
How Simulint Helps with BlueSphere Fabric
BlueSphere Fabric, Simulint's managed IT service, includesvulnerability and asset management with set remediation timeframes, pluspatching mapped to CIS and NIST baselines. We track what you own, fixreal-world risk first, and report progress in plain terms. Learn more at https://www.bluesphere.co/bluesphere-fabric.
