---
title: Threat and Vulnerability Management Needs Better Visibility
description: To improve threat and vulnerability management requires understanding which vulnerabilities pose the highest risk. How do you do that?
image: https://www.morphisec.com/hubfs/shutterstock_1209143419.jpg
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# How Do You Prioritize What to Patch?

Posted by [Kate Ulansky Aharon](https://1534169.hs-sites.com/author/kate-ulansky-aharon) on September 7, 2022

Find me on:

[LinkedIn](https://www.linkedin.com/in/kate-ulansky-aharon/)

- [Tweet](https://twitter.com/share)

Today, threat and vulnerability management is [more critical than ever](https://1534169.hs-sites.com/the-pain-of-patching), with unpatched vulnerabilities involved in [60 percent of data breaches](https://www.comparitech.com/blog/information-security/cybersecurity-vulnerability-statistics/#:~:text=Unpatched%20vulnerabilities%20were%20involved%20in%2060%25%20of%20data%20breaches). Vulnerability tools of all stripes abound, yet for all their features, few offer a clear path to action. Identifying the most impactful patches is a challenge for organizations across borders and industries. According to independent cybersecurity researchers the Ponemon Institute, 57 percent of businesses don’t know [which vulnerabilities pose the highest risk](https://resources.infosecinstitute.com/topic/key-findings-from-ponemons-state-of-vulnerability-management-in-the-cloud-and-on-premises-report/). Without this critical insight, patching prioritization is impossible.

Vulnerability management tools rely on a variety of sources to prioritize common vulnerabilities and exposures (CVEs). These include [CVSS scores](https://nvd.nist.gov/vuln-metrics/cvss), the status of exploits, the age of exploits, and more. Tools that include these data points provide important context, but they overlook one glaring issue. If an application isn’t running, hasn’t run in the past, and/or won’t run in the future, these data points are irrelevant.

![Shutterstock_1911642022](https://www.morphisec.com/hubfs/Shutterstock_1911642022.jpg)

Application usage creates an attack surface composed of the application’s contents: executables, services, and libraries. An application’s contents become available in memory at run time, providing points of entry for an attacker who knows how to exploit them. (Read [Why Should You Care About In-Memory Attacks?](https://1534169.hs-sites.com/runtime-attacks-in-memory)) Hardly any applications are immune. BitDefender reported 76 percent of applications have [at least one vulnerability](https://businessinsights.bitdefender.com/10-stats-on-the-state-of-vulnerabilities-and-exploits).

However, if an application doesn’t run, its components under the hood are unavailable for both benign and malicious purposes. In other words, an unused application poses almost no risk.

In fact, vulnerability reports that surface unused applications actually increase risk. How? By diverting focus from the most critical patching efforts that truly require your attention. These are the most used applications that make up your largest attack surface, one that’s unique to your organization.

![shutterstock_1209143419](https://www.morphisec.com/hubfs/shutterstock_1209143419.jpg)

## Deciding What to Patch

CVEs are the gateway for some of today’s most devastating threats, including many strains of ransomware. (Read [How to Resolve the Ransomware Security Gap](https://1534169.hs-sites.com/how-to-prevent-ransomware).) While patching is the first line of defense across the board, patching the right things—rather than everything—is key to effective security.

With an overwhelming list of patches to implement, it’s impossible for most cybersecurity teams to address every vulnerability, or even every high severity vulnerability.

Invisible vulnerabilities can’t be prioritized and patched, so vulnerability visibility is fundamental to cyber hygiene. Once vulnerabilities are identified, time is of the essence. However, patch times remain glacially slow. Heimdal Security reports the [average time to patch](https://heimdalsecurity.com/blog/software-patching-statistics-practices-vulnerabilities/) is 67 days.

The result: attackers have plenty of time to exploit unpatched weaknesses for malicious ends like stealing data, encrypting files, or denying service.

![shutterstock_1928422565](https://www.morphisec.com/hubfs/shutterstock_1928422565.jpg)

## What’s at Stake?

Unfortunately, creating a patch doesn’t eliminate an application from an attacker’s list of targets. This is because on average, it takes [between 60 and 150 days](https://resources.infosecinstitute.com/topic/time-to-patch-vulnerabilities-exploited-in-under-five-minutes/) for a business to patch a vulnerability, leaving a potentially catastrophic gap in exposure. In fact, because patches are usually reverse engineered, it's often easier for an attacker to create an exploit after a patch is released and before it’s implemented.

Despite vulnerabilities being the top way ransomware is perpetrated, in 2019, 60 percent of breaches were [due to unpatched vulnerabilities](https://securityboulevard.com/2019/10/60-of-breaches-in-2019-involved-unpatched-vulnerabilities/). The average cost of a security breach hovers around [$4 million](https://www.complianceweek.com/cybersecurity/ibm-report-average-data-breach-cost-nearly-4m-in-past-year/29258.article#:~:text=An%20IBM%20report%20that%20examined,days%20to%20identify%20and%20contain.), which is particularly galling given most breaches could have been prevented by a patch.

![shutterstock_158095634](https://www.morphisec.com/hubfs/shutterstock_158095634.jpg)

## Third Party Applications Require Dedicated Monitoring

Patching is required at all levels of an environment—hardware, OS, and network. But there is a particular challenge inherent in managing the vulnerabilities of the hundreds of disparate third party applications like Slack, Zoom, Python, and Docker installed across organizational endpoints.

A 2019 Okta study found nearly 10 percent of businesses have [more than 200 applications installed](https://www.wsj.com/articles/employees-are-accessing-more-and-more-business-apps-study-finds-11549580017) on average, and the number of applications deployed by large firms had increased 68 percent over the prior four years. Organizations need a centralized view of third party applications to ensure the right things get patched, and the wrong things aren’t installed.

Top of mind for vulnerability assessment is the infamous “unholy trinity” of applications from which a notably high number of vulnerabilities tend to originate: Acrobat Reader, Chrome, and Java. Not only are these applications frequent sources of vulnerabilities, they are also frequently used, making them weak links in every organization’s security posture.

## ![shutterstock_180369836](https://www.morphisec.com/hubfs/shutterstock_180369836.jpg)

## Threat and Vulnerability Management Requires Visibility

So how can you get the visibility you need into application usage to effectively prioritize patches? Morphisec Scout’s technology shows third party Windows applications installed in your environment, providing vulnerability visibility into hundreds of the most commonly-used applications so you can improve your IT hygiene.

Uniquely in the market, Scout prioritizes which applications to patch based on CVE severity as well as application usage. This reflects the true risk posed to your specific organization on a daily basis. Scout provides a clear path to patching priority, saving you the work of deducing risk from general data points. It facilitates a healthier security posture by eliminating risk factors such as applications that are unused, out-of-date, or out-of-policy. This lets you focus patching efforts on the applications that will make the biggest dent in your organization's exposure.

Learn more about [Morphisec Scout](https://www.morphisec.com/products/morphisec-scout-vulnerability-management) and how it can uniquely reduce your security risk—[request a demo](https://engage.morphisec.com/contact-us?hsCtaTracking=53b2e072-87f9-4681-8a74-768a97e6d9e6%7Ce2919ea2-dfc3-4eee-8cc4-63680a96cbd0) now.

 

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/threat-and-vulnerability-management#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Kate Ulansky Aharon",
    "url" : "https://1534169.hs-sites.com/author/kate-ulansky-aharon"
  },
  "dateModified" : "2023-07-03T17:47:11.667Z",
  "datePublished" : "2022-09-07T14:30:00.000Z",
  "headline" : "Threat and Vulnerability Management Needs Better Visibility",
  "image" : [ "https://www.morphisec.com/hubfs/shutterstock_1209143419.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/threat-and-vulnerability-management",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```