Why patching still decides most breaches

Look at the initial access vector in published breach reports and a pattern repeats: an internet-facing service with a vulnerability that had a fix for weeks or months. Attackers scan the whole internet within days of a disclosure.

Know what faces the internet

Your patch priority should start with anything reachable from outside: VPN gateways, mail servers, file transfer tools, remote management. Keep that list current; shadow services are where old versions hide.

Measure time to patch

Track the days between a vendor fix and deployment for critical systems. If that number is measured in months, it matters more than any new tool you could buy.

Plan for the systems you cannot patch

Legacy equipment exists. Isolate it, restrict who can reach it, and monitor it closely, so “cannot patch” does not become “cannot defend”.