Manufacturing Vulnerability Backlog and OT Uptime
MidState Manufacturing has 2,600 managed endpoints, 180 servers, and 900 OT devices across three plants. The quarterly vulnerability scan returns 18,400 findings: 47 CVSS 9.8, 620 high, and 12,000 medium. The 47 critical findings include 12 on internet-facing VPN appliances, 9 on a Windows Server 2012 print server, and 26 on OT human-machine interfaces that run a vendor-locked Windows 7 image. The plant manager refuses patching during production; the next shutdown is in 11 weeks. The IT patch window is the first Saturday monthly, four hours. The vulnerability team has two analysts and no asset inventory beyond the scanner's IP list. The CISO asks which findings to remediate first and what metric to report to the board. A recent penetration test found the VPN management interface reachable from the internet on an unpatched firmware version.
1. Which findings should be remediated first, and why? Build a defensible prioritization.
Read the worked answer
Rank by exploitability and exposure, not CVSS alone. First: the 12 internet-facing VPN appliances. They are reachable by anyone, and a compromised VPN gives a foothold; check CISA KEV and vendor advisories, patch or apply vendor mitigation within 72 hours, and restrict management interfaces to an allowlist. Second: the 9 print-server findings on unsupported Windows Server 2012. It cannot be fully patched, so isolate it, disable unnecessary services, and migrate or decommission within 30 days. Third: the 26 OT HMIs. They are not internet-facing, but a compromised HMI could affect production safety; the 11-week shutdown is too far away for patching, so apply network segmentation, restrict remote access, enable application allowlisting, and ask the vendor for mitigations. The 620 high findings follow by asset criticality. Do not let the 12,000 medium findings consume the two analysts.
2. What metric should the CISO report to the board, and how should OT exceptions be governed? Justify both.
Read the worked answer
Report risk reduction, not raw counts. The board should see the percentage of known-exploitable vulnerabilities remediated within SLA, for example KEV within 14 days, the number of internet-facing critical findings with an approved compensating control, and mean time to remediate by asset tier. Add OT coverage: percentage of HMIs with network segmentation and vendor-approved mitigations before the shutdown. A count of 18,400 findings invites either panic or numbness and does not show whether the VPN exposure was closed. Pair the metric with a simple trend and a named owner for exceptions. Govern OT exceptions with a time-bound waiver signed by the plant manager and CISO, listing compensating controls, a re-review date at the shutdown, and tracking to closure. This connects the vulnerability program to the board's real question: which exposures can hurt us, and how fast are we closing them?