Nine Thousand Vulnerabilities, Two Analysts

Ranking:

1. VPN appliance - emergency change, 24–48 hours. Two factors multiply: it is internet-facing (reachable by anyone) and the vulnerability is exploited in the wild (a working exploit exists and is in use). Certain likelihood against a perimeter asset. Options in order of preference: patch out-of-band, restrict access to known source ranges, or take it offline and use an alternate access path. This is the only item where 'we will handle it in the monthly window' is the wrong answer.
2. MRI workstation - isolate this week, patch never (by contract). The likelihood of remote exploitation is lower once it is not reachable from the internet, but the impact is high and, critically, the exposure is permanent. You cannot wait for Q3 to start reducing it. The decision to make now is not 'patch it,' it is 'contain it.'
3. 300 laptops - schedule into the next patch window. Largest aggregate volume and the easiest win, but distributed, patchable, and not currently known-exploited. Volume alone does not put it first; if the missing updates include a known-exploited CVE, that changes and it jumps ahead of the MRI.

The principle: ranking is likelihood × impact × remediability. An item you cannot fix needs a different decision (contain), not a later slot in the same queue.

Containment, not remediation. Since you cannot fix the host, shrink everything around it:

• Network ACLs: permit traffic only between the MRI workstation and the PACS/image server on the specific ports required. Deny all other inbound and outbound, including internet.
• No user browsing or email on that host; it is a clinical appliance, not a desktop.
• Passive monitoring: mirror the switch port to the IDS so you get visibility without an agent.
• Physical and logical access control: restrict who can log on locally; remove shared accounts if any exist.
• Vendor engagement in writing: get the Q3 commitment in writing and ask about virtual patching or an approved IPS signature in the meantime.
• Contingency: document how the machine can be disconnected in minutes without halting imaging workflow.

Recording the exception:

• Risk statement in clinical terms: patient imaging availability versus malware propagation.
• Named risk owner: the radiology director and the CISO, both signing - not the analyst.
• Compensating controls listed explicitly, so the residual risk is demonstrably smaller than the raw finding.
• Expiry tied to the vendor's patch date and revisited at every vendor release, not a permanent waiver.
• Review trigger: any anomalous traffic to or from the host, or any new exploited Windows 7 CVE.

Judgement point: the radiology director's 'not negotiable' applies to patching. Isolation was never on the table for negotiation, and framing it that way keeps the relationship intact.

Triaging the 9,100:

1. Collapse noise. The same CVE on 400 identical laptops is one remediation task, not 400 findings. Deduplicate by CVE plus asset group.
2. Filter by exploitability. Prioritise anything on the CISA KEV list or with high EPSS scores; a critical CVSS with no known exploit and no reachable path is not this month's problem.
3. Join to asset criticality. Findings on domain controllers, the payment environment, and clinical systems outrank findings on a test VM - and you cannot do this without asset tagging, which is the prerequisite the CISO did not ask for.
4. Separate the streams: patchable-now, needs-compensating-control, and formally accepted exceptions. Exceptions leave the working backlog but stay on the risk register.
5. Assign owners outside security. Two analysts cannot patch 1,400 assets; they can drive the people who can.

Metrics to report:

• Not raw vulnerability count - it moves with scanner settings and discourages honest reporting.
• Critical and high findings on crown-jewel assets, and how long they have been open (age buckets, not totals).
• Mean time to remediate by tier, and percentage remediated within SLA.
• Exception count and how many are past their review date.
• Exposure reduction on internet-facing assets specifically.

Why: the CISO needs to know whether the organisation is getting safer and where it is stuck. A count of 9,100 answers neither question.