Skip to content
Security Reality Check
Menu

← All insights

Patching and exposure

These articles look at what a patch report does and does not prove, and at what limits exposure before a fix is applied.

A completion percentage is only useful when you know its inventory, exclusions, aging exceptions, and the exposures that need action before a patch can be applied.

  • What a patch report does and does not prove

    A completion percentage is not the same as evidence that exposure is going down. Ask for the record that shows it.

    Ask your provider or team

    Which systems are outside the current inventory, and how would we find out?

    · 2 min read

  • When the patch loses the race

    Exploitation can now start before a fix exists. Ask what limits what an attacker can reach, not just how fast you patch.

    Ask your provider or team

    Which systems are internet-exposed, and could any of them be made not internet-exposed?

    · 3 min read

  • What your MSP contract actually covers

    Read your managed service agreement alongside operational evidence to understand coverage and responsibilities.

    Ask your provider or team

    After an alert, which of human review, investigation, and containment does the service include?

    · 2 min read

Browse by topic

Want to discuss a security question?

If an article raises a question about your providers, recovery evidence, or security responsibilities, tell us what you have and what you need to decide.

Talk with us