How to track the vulnerabilities that actually matter to you

Every organisation that has had a scare goes through the same phase: somebody signs up to half a dozen feeds, forwards everything to a group inbox for three weeks, and then quietly stops reading any of it. The problem was never a shortage of information. It is that almost none of it applies to you, and the handful that does is buried.

Start with what you run, not with what is published

The filter has to work the right way round. Most people start from the advisory and ask whether it affects them. That is backwards and exhausting. Start from a list of what you actually have, and only then look at what is published against it.

For a small organisation that list is shorter than you think. Something like:

• Your operating systems and browsers, which update themselves if you let them.
• Your identity provider, for most people Microsoft 365 or Google Workspace.
• Whatever your website runs on. WordPress, Drupal, Magento, or something bespoke sitting on PHP.
• Anything exposed to the internet: a VPN appliance, a firewall, a remote access gateway, a file transfer tool.
• The handful of line-of-business applications you could not operate without.

Write that down once. It takes an hour and it is the single most useful security document a small organisation can own, because it turns an unbounded reading task into a bounded one.

The categories worth reacting to immediately

Of everything published, two kinds warrant dropping what you are doing.

Anything internet-facing with unauthenticated remote code execution. A VPN appliance, a firewall, a file transfer product, a web platform. No login required and the attacker reaches it from anywhere means mass scanning starts within hours of publication, and nobody is being singled out.

Anything already being exploited. A flaw with a high score that nobody is using is a patching task. A flaw with a lower score that is being actively used is an emergency. The CISA Known Exploited Vulnerabilities catalogue is the best free list of the second category, and it is deliberately short.

Everything else goes into normal patching. For Cyber Essentials that means high risk and critical updates applied within fourteen days, which is a reasonable bar for anyone whether or not they are certified.

Three sources, and that is enough

NCSC news and advisories, because when the NCSC says act now it is both credible and UK-specific. Their Early Warning service is free to UK organisations and tells you when they see signs of compromise or vulnerable services associated with your own networks, which is considerably more useful than a general feed.

Your vendors. Whoever makes your firewall, your VPN and your web platform publishes advisories, and those are the ones that definitely apply to you. Subscribe to the few that matter rather than the many that might.

Someone filtering it for you. We publish the UK security news we think is worth a smaller organisation’s attention at SecNews, which exists because the mainstream coverage is written either for enterprise security teams or for nobody in particular.

The question that actually settles it

When something significant lands, the useful question is rarely “are we vulnerable”. It is “who would fix this, and have they”.

For most small organisations the answer to the first half is somebody else: a hosting company, a web agency, an IT provider. Which means your job is not patching, it is asking, in writing, and keeping the answer. We wrote a worked example of exactly that during the recent PHP flaws, where the whole task for a business owner came down to three questions put to their web host.

One of those three is the one people forget: has the service been restarted since the patch was applied. A server can be fully updated on paper and still running the vulnerable version in memory, and that gap has caught out organisations far larger than yours.

What not to do

Do not run the checker scripts that circulate after a big disclosure. Plenty are unverified and some carry malware. After any high-profile vulnerability there is a reliable wave of tools promising to tell you whether you are affected, and running one against your own estate is a poor trade.

Do not let a feed become the work. If reading advisories is consuming time that would be better spent on multi-factor authentication coverage, a tested backup and knowing who can reach what, the feed is costing you security rather than buying it.

Do not confuse knowing with knowing your own estate. Awareness of a vulnerability is worth nothing if you cannot answer what you run it on. If the inventory above does not exist, build it before subscribing to anything.

Where testing fits

Tracking advisories tells you what has been published. It does not tell you what is actually exposed on your own systems, which is frequently something nobody published an advisory about at all: a forgotten remote access route, a permission nobody reviewed, a service that should not be reachable. That is what vulnerability management and a penetration test are for, and the two answer different halves of the same question.

Common questions