Comment

Most organizations will avoid patching due to the downtime alone, instead using other mitigations to avoid exploitation.

If you can’t patch because of downtime, maybe you are cheaping out too much on redundancy?

Sort:hotnew top

PiJiNWiNg@sh.itjust.works ⁨1⁩ ⁨month⁩ ago
That immediately stuck out to me as well, what a lame excuse not to patch. I’ve been in IT for a while now, and I’ve never worked in any shop that would let that slide.

source
redfox@infosec.pub ⁨1⁩ ⁨month⁩ ago
Yeah, that’s pretty risky for this point in time.

I guess the MBA people look at total cost of revenue/reputation loss for things like ransomware recovery, restoration of backups vs the cost of making their IT systems resilient?

Personally, I don’t think so (in many cases) or they’d spend more money on planning/resilience.

source