[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBR0QuUX0dnq_JiyE6b0M0qNXW9hFeerUgbZzemRAvvY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41},"cac68394-ff54-496a-8e0b-d595afc4cf48","cisa-finds-most-breaches-exploit-known-unpatched-vulnerabilities","2d722875-cae9-4aa5-9c0a-a4e7eb8f7f72","CISA Finds Most Breaches Exploit Known, Unpatched Vulnerabilities","CISA's FY2024-2025 Vulnerability Review confirms that the majority of cyber compromises stem from well-known, catalogued vulnerabilities that organizations have failed to patch or mitigate in a timely manner. This represents a systemic failure in basic security hygiene rather than sophisticated zero-day exploitation, meaning most breaches were preventable. The review underscores that without a risk-based prioritization framework — accounting for exposure, exploitability, and Known Exploited Vulnerability (KEV) status — organizations waste remediation resources on low-risk findings while critical gaps remain open. Adopting Secure by Design principles shifts the burden of security upstream to software vendors, reducing the volume of vulnerabilities organizations must manage reactively.","**Immediate actions:**\n- Cross-reference your asset inventory against CISA's Known Exploited Vulnerabilities (KEV) catalog and prioritize patching any matches within 24–72 hours.\n- Run authenticated vulnerability scans against all internet-facing assets to identify unpatched, high-exposure software flaws.\n\n**Long-term improvements:**\n- Implement a risk-based vulnerability management program that scores findings by exposure, KEV status, exploitability, and business impact rather than CVSS score alone.\n- Establish a formal SLA-driven patch management policy with defined remediation timelines tiered by severity (e.g., Critical: 15 days, High: 30 days).\n- Require vendors to demonstrate Secure by Design practices — such as memory-safe languages and reduced default attack surface — as part of procurement criteria.\n\n**Detection & monitoring measures:**\n- Deploy continuous monitoring tooling (e.g., CTEM platforms) to detect newly disclosed vulnerabilities affecting your technology stack within hours of publication.\n- Integrate threat intelligence feeds that flag active exploitation in the wild, triggering escalated response workflows for affected CVEs.",[12,13,14,15,16,17,18,19,20],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 2 – Inventory and Control of Software Assets","NIST SP 800-53 SI-2 (Flaw Remediation)","NIST SP 800-53 RA-5 (Vulnerability Monitoring and Scanning)","NIST CSF ID.RA-1 – Asset vulnerabilities are identified and documented","NIST CSF RS.MI-3 – Newly identified vulnerabilities are mitigated or documented as accepted risk","CISA Known Exploited Vulnerabilities (KEV) Catalog","CISA Secure by Design Principles","NIST SP 800-40 r4 – Guide to Enterprise Patch Management Planning","published","2026-08-26T17:20:25.23934+00:00","2026-08-26T17:20:24.856+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fresources\u002Fcisa-vulnerability-review","cisa-vulnerability-review-90a843","CISA Vulnerability Review",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":36,"name":37,"slug":38,"description":39,"color":40},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[]]