- Check exploitation and reachable attack paths before sorting by scanner severity.
- Give every delayed fix a tested temporary control, an owner, and an expiry.
- Verify the update and investigate possible compromise as separate tasks.
An urgent advisory arrives during payroll processing. The affected appliance is reachable from the internet, but restarting it would interrupt remote staff. A scanner also lists dozens of critical findings on internal systems. Which work should move first, and who can authorize the disruption?
That is a patch-triage decision. A severity score helps describe a vulnerability; it does not describe your exposure, operational dependencies, or ability to recover from a failed update.
Build the queue around reachable exposure
CISA's Known Exploited Vulnerabilities catalog identifies vulnerabilities with evidence of exploitation. Use it alongside the vendor advisory and your asset inventory. An absent KEV entry does not establish that a vulnerability is safe to defer.
For each candidate, confirm the installed version, whether the affected feature is enabled, who can reach it, and what privilege exploitation would provide. Check the actual access path. A management page behind a proxy may still be exposed through an overlooked hostname or remote-support connection.
Give identity systems, backup infrastructure, remote access, and deployment tooling particular attention. Compromise there can affect systems beyond the vulnerable host. For SaaS, record whether the vendor owns remediation and what configuration or investigation work remains yours.
A worked prioritization example
Consider this hypothetical queue, not a report of a client incident:
| Finding | Local evidence | Proposed decision |
|---|---|---|
| Exploited flaw in a public remote-access appliance | Affected version and feature confirmed | Approve emergency remediation or restrict the service while applying the vendor mitigation |
| Critical package flaw on a disconnected test host | No route from production; vulnerable function unused | Schedule a tested update and verify the isolation assumption |
| Lower-rated flaw in a backup console | Reachable by ordinary user devices; backup deletion possible | Restrict access immediately and bring the fix forward |
These are decisions to validate, not a universal ranking. If the test host contains production credentials, or the appliance mitigation does not cover the attack path, the order changes. Capture the evidence behind the decision so the next engineer can challenge it.
Make a delay explicit
An exception record should name the system, advisory, business owner, reason for delay, temporary control, verification result, and expiry. It also needs someone authorized to accept the remaining business risk.
For example: a maintenance dependency blocks an update; the network owner restricts administration to a dedicated management subnet; an external check confirms the public interface is unavailable; the application owner approves the next maintenance window. Record the dates and ticket references. A proposed firewall rule is not evidence that the rule works.
For a small team, this can be a short shared register. Review urgent exceptions whenever exposure changes, rather than waiting for a monthly meeting. Escalate a missed deadline to the named owner with the service impact of the remaining options.
Close two separate tasks
First, verify the installed version, service health, and business workflow after the update. Retain a rollback plan that does not quietly return the system to public exposure.
Second, investigate whether exploitation preceded remediation. Follow the vendor's investigation guidance and preserve relevant authentication, application, endpoint, and configuration records. Look for unexpected accounts, credentials, jobs, or outbound connections. Patching cannot remove persistence that an attacker has already established.
Report the exposed systems still unresolved, their temporary protections, and the decisions needed. Keep the full scanner export available for engineering; give leadership the exceptions it can act on.
Turn this response guidance into clearer roles, containment decisions, evidence paths, and executive briefing rhythm.