In the ACSC's annual cyber threat report, one finding appears year after year: the majority of successful cyber attacks on Australian businesses exploited vulnerabilities that had patches available. Not zero-day attacks. Not sophisticated state-sponsored intrusions. Known vulnerabilities with published fixes.
This means the question isn't whether Australian SMBs have vulnerabilities — they do. The question is whether those vulnerabilities are being closed in time. And for most businesses, the answer is no.
It's not that businesses don't know patching matters. It's that the way most businesses patch creates the very disruption they're trying to avoid:
The result: businesses delay patching to avoid disruption. The delay creates risk. A vulnerability stays open for weeks or months. When an incident happens, the patch that would have prevented it was available the whole time.
Proper patch management, using Microsoft Intune, eliminates the disruption problem entirely. Here is what it looks like in practice:
Two of the eight Essential Eight controls relate directly to patching: Patch Applications and Patch Operating Systems. At ML1, patches must be applied within one month. At ML2, the requirement is 48 hours for internet-facing services and two weeks for everything else.
If your business is applying for cyber insurance, the insurer will ask about your patch management process. 'We do it when we can' is not an acceptable answer. A documented, automated patch management programme with compliance reporting is.
Most businesses don't know their actual patch status. They assume devices are roughly up to date. When we run a first compliance report, the reality is usually different:
A baseline patch compliance assessment takes one day. If you don't know your current status, that's the right place to start.
We identify the gaps and tell you exactly what to fix first.
