Almost every serious incident I have helped clean up had the same quiet ingredient: a known vulnerability, with a patch available, that nobody had gotten around to applying. Not a zero-day. Not nation-state wizardry. A fix that had been sitting in a vendor advisory for weeks or months while everyone found reasons to wait. The exploit was public. The patch was public. Only the urgency was missing.
Patching is unglamorous work, and that is exactly why it slides. There is always something more visible to do. Applying an update carries a small, immediate risk of breaking something, while skipping it carries a large, deferred risk that lands on a day nobody can predict. Human nature reliably picks the deferred risk, especially when the reboot is inconvenient and the system "seems fine." So the queue of unpatched things grows, quietly, until an attacker turns that queue into an incident.
What changed my teams was treating patching as a scheduled, boring rhythm rather than a heroic scramble after each scary headline. A regular maintenance window that people plan around. A known cadence for how fast a critical fix gets applied versus a routine one. The goal is that patching is a habit the organization has muscle memory for, not a fire drill that competes with everything else for attention every single time.
The other half is knowing what you actually run. You cannot patch what you have forgotten you own. The internet-facing box someone spun up two years ago for a demo and never decommissioned is precisely where an unpatched flaw becomes a breach, because it is unmonitored and off everyone's mental map. An honest inventory is unglamorous too, and just as load-bearing.
I am not pretending patching is risk-free. Updates do break things, and blindly auto-applying everything to production is its own failure mode. The answer is a tested path: apply to a staging tier, watch, then roll forward, with a rollback ready. That discipline costs real time.
But the math is not close. The cost of a controlled patch is an afternoon and an occasional rollback. The cost of the exploit you invited by waiting is measured in incident calls, regulators, and trust you do not get back.
– Serguey Shinder
