Lesson 05 · 3 min · 5 things to do
A patch starts a clock
Explain why publishing a fix raises risk before it lowers it.
A vendor publishes a security fix and describes what it fixes. What does that publication do?
- Yes.A fix is a description of the flaw, whether or not anyone writes it out. Comparing the old and new versions shows what changed — so publication starts a race between those installing it and those studying it.
- Not quite.It closes it for anyone who installs the patch. Until then the flaw is more exposed than it was the day before.
- Not quite.It changes the information available immediately, which is the point of this lesson.
A patch is a public description of a weakness. From the moment it exists, the safest place to be is patched, and the most dangerous is aware but unpatched.
Slide the days after a fix is published.
Day 0Day 3Day 30A yearSystems patched5%Attempts to use the flaw2%Day 0The fix is out. A handful of fast-moving organisations have applied it.
Systems patched22%Attempts to use the flaw70%Day 3Working attack code circulates. Patching has barely started in most organisations.
Systems patched78%Attempts to use the flaw95%Day 30Most have patched. The remainder are being found by automated scanning.
Systems patched93%Attempts to use the flaw60%A yearStill a long tail unpatched — usually systems nobody remembers owning.
Where is the most dangerous window?
- Yes.This is why serious vulnerabilities are patched in hours rather than at the next maintenance window — the gap between publication and installation is the entire risk.
- Not quite.Unknown flaws are dangerous and are used against few targets. A published one is used against everybody.
- Not quite.The unpatched tail is real and small, and it is where an organisation that has lost track of its own systems gets caught.
Move the control to see what changes.
Which of these shorten the dangerous window?
Knowing which systems you actually run.
Being able to patch without waiting for a monthly window.
Automatic updates on internet-facing systems.
A stronger firewall.
More frequent security reviews.
Yes.Everything that works is about speed and inventory. You cannot patch what you have forgotten you own — which is why asset inventory, the dullest control in security, is one of the most valuable.A patch is published on day 0 and an organisation applies it on day 21. Attack attempts begin on day 3. How many days was it exposed to a publicly known flaw?
daysYes.Eighteen days of a weakness that was documented, tooled and being scanned for. Most successful intrusions use flaws with patches available — often for far longer than eighteen days.Why do researchers usually tell the vendor before publishing?
- Yes.Publishing first means the window opens with nothing available to close it. The argument over how long a vendor should get is a real one; the sequence itself is not seriously disputed.
- Not quite.Laws vary and are genuinely difficult in places. The practice is a norm rather than a universal rule.
- Not quite.Deadlines are usually set precisely to stop that — a fix that never ships leaves users exposed indefinitely.
Lesson complete
A published patch tells defenders to hurry and everyone else where to look.
Next: A backup is a claim until restored →