Who Is Patching the Software That Runs Your Business?

Think about the software your business runs that isn't a website.

The file server in the back office. The accounting system on a machine in the closet. The camera system, the door system, the remote desktop someone set up so you could work from home. The open-source tools a former employee installed because they were free.

Now answer two questions honestly: when was each one last updated, and who would know if one of them had a critical hole in it today?

For most businesses, the answer to both is "nobody knows."

Software does not stay safe on its own

Software is never finished. Every week, researchers and vendors publish new vulnerabilities - flaws that let someone in who shouldn't be. The fix is usually an update. The danger is the gap between the day the flaw is published and the day somebody installs that update.

The US government keeps a public list of these: the Known Exploited Vulnerabilities catalog from CISA. Every entry is a flaw that has been confirmed as used in real attacks, not just a theory. Federal agencies are required to patch those by a deadline.

Your business isn't bound by that list. Attackers read it anyway.

How malware actually gets in

It is rarely a movie-style break-in. It's usually something ordinary that nobody was watching:

• A system facing the internet with a known hole - a VPN, a remote desktop, a file share, an old web app - that was never updated.
• A tool installed for one job and forgotten. Still running, still reachable, years behind on updates.
• A default or reused password on a device nobody thinks of as a computer, like a camera recorder or a printer.
• One infected laptop that reaches every file share on the network because nothing separates them.

Then comes the part that makes the news: ransomware that locks every file and demands payment, often after quietly copying your data out first. By the time anyone notices, the decision isn't whether you were attacked. It's how much you lost.

"It's open source, so it's free"

Open source software is some of the best software in the world, and we use plenty of it. But it is free to download, not free to run.

Someone still has to install it securely, keep it updated, read the security notices and act on them. Take a tool like Wazuh: an open-source security platform that can watch your machines for known vulnerabilities, suspicious logins and files that change when they shouldn't. It is genuinely powerful. It also needs setting up, tuning so it doesn't drown you in noise, and a person who reads what it says.

A security tool that alerts nobody is decoration.

What watching it properly looks like

Real vulnerability management isn't a product you buy once. It's a routine:

• Know what you run. An up-to-date list of every machine and service, and which version of what is on it.
• Scan continuously. Match that list against newly published vulnerabilities, automatically, every day.
• Patch on a schedule. Routine updates regularly, and the critical ones - especially anything on the exploited list - fast.
• Alerts that reach a person. A real human who gets told, understands it, and acts.
• Expose less. Internal tools reachable only through a private network, not sitting open on the internet.
• Keep logs somewhere safe, so an intruder can't erase their tracks.
• Back up off-site and test the restore, so ransomware is a bad day rather than the end of the business.

How we do it

We run this exact discipline on our own servers every day: open-source vulnerability and threat monitoring on every machine, scanning of the software images our services run on, alerts that reach a person, and internal tools that live on a private network instead of the open internet.

For clients, it's the same work:

• A security review and hardening of what you already run, with a plain-English report of what's exposed and the fixes done, not just listed.
• Self-hosted and on-premises systems set up properly, with monitoring and automated backups from day one.
• Ongoing maintenance, from $200 a month, so the patching and the watching keep happening after we leave.

If you're not sure who should be getting the call when something breaks, start with this post.

The bottom line

Every business now runs software, whether it thinks of itself as a tech company or not. The ones that get hurt usually aren't the ones with the worst software. They're the ones where nobody was watching it.

Want to know what's running in your business and how exposed it is? Get a tech quote.

Source: CISA - Known Exploited Vulnerabilities Catalog.