Vulnerability administration: Most orgs have a backlog of 100K vulnerabilities

The risk panorama by no means stands nonetheless. Nearly daily there’s a brand new vulnerability rising in some type or one other. In reality, based on NIST, there have been 18,378 vulnerabilities reported in 2021, and most organizations’ vulnerability administration applications aren’t match for goal.

Every of those vulnerabilities presents a possible entry level for attackers to take advantage of and achieve entry to delicate data. Nevertheless, many organizations lack the interior experience or assets to patch these vulnerabilities on the tempo required to maintain their environments safe. 

New analysis launched by Rezilion and Ponemon Institute at present discovered that 66% of safety leaders report a vulnerability backlog of over 100,000 vulnerabilities. It additionally revealed that 54% say they have been capable of patch lower than 50% of vulnerabilities within the backlog. 

Above all, the info signifies that the best way most enterprises strategy vulnerability administration isn’t scalable or match for goal, and it’s offering cybercriminals with ample avenues to achieve entry to mission-critical information. 

Why vulnerability administration is proving tough 

The struggles of vulnerability administration aren’t essentially new. In response to NTT Software Safety, the typical time to repair a vulnerability in 2021 was 202 days. Rezilion’s analysis additionally highlights that remediation is an issue, with 78% saying that high-risk vulnerabilities take longer than 3 weeks to patch. 

On the coronary heart of this failure to mitigate vulnerabilities successfully, is the dearth of mandatory instruments. 

“What it comes all the way down to is an absence of instruments, folks and data to correctly deal with this problem. Respondents to the survey say there are a variety of the reason why that is taking so lengthy, together with the lengthy period of time it takes and the complexity of the duty,” mentioned CEO and cofounder of Rezilion, Liran Tancman. 

“Among the components they talked about embody an lack of ability to prioritize what must be mounted, and an absence of efficient instruments and an absence of assets. The shortage of assets isn’t a surprise because the expertise crunch in safety is nicely documented,” Tancman mentioned. 

Tancman additionally highlights that few organizations have the visibility or context mandatory to find out what wants patching, which makes tackling a backlog overwhelming. 

Nowhere is that this lack of visibility extra clearly demonstrated than with many organizations’ failure to patch Log4j, with a report launched earlier this yr discovering that 70% of companies who beforehand addressed the vulnerability of their assault floor are nonetheless struggling to patch Log4j-vulnerable property and forestall new situations resurfacing.

Automation is the reply 

Fortuitously, automation gives an efficient reply to the problem of vulnerability administration by enabling safety groups to automate the vulnerability scanning course of and constantly establish exploits.  

This not solely decreases the time taken to remediate vulnerabilities, however frees up the safety staff to deal with more-rewarding duties. Rezilion’s analysis means that automation is usually a vital drive multiplier for safety groups, with 43% saying there was a considerably shorter time to reply.

It’s price noting that, for the most effective outcomes, organizations ought to look to implement options that provide risk-based prioritization in the event that they need to maximize the effectiveness of their vulnerability administration program. 

“One of many greatest adjustments you may make is to deal with the vulnerabilities which are being exploited within the wild. That needs to be the No.1 aim and can drive down probably the most danger the quickest,” mentioned Craig Lawson, VP Analyst at Gartner, in a weblog submit. 

Suppliers like Tenable, Balbix and Seemplicity are all experimenting with risk-based vulnerability administration to assist safety groups deal with patching high-risk vulnerabilities first, primarily based on present exploitation exercise and publicity, in order that they don’t waste time on lower-value vulnerabilities.