I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses:

  1. We haven't had any issues yet (I would add that we know of)
  2. We just don't think it's that big of a risk.


Are there any resources available that can help me sell this idea?

I've been told that 55-85% of all security related issues can be resolved by proper anti-virus and patch/update management but the individual that told me couldn't substantiate the claim. Can it be substantiated?

Additional Information

1/5 of our computers (the ones on the building) have Windows update turned on by default and anti-virus installed. 4/5 of our computers are outside corporate and the users currently have full control over anti-virus and Windows updates (I know this is an issue, one step at a time).

  • Hello James, cross posting is highly discouraged. serverfault.com/questions/518819/… Jun 26, 2013 at 19:54
  • @LucasKauffman (copied from my response on sf.se. Bottom line, it was unintentional.) I recognize that (I've been around SE for a while). After posting on security.SE I thought I probably should have posted on SF.SE. I intended to delete the first question but it was answered first. My bad :)
    – James Hill
    Jun 26, 2013 at 19:56
  • 1
    allright then :) Jun 26, 2013 at 19:57

3 Answers 3


The claim can be substantiated by checking the successful exploit rates against (e.g.) Secunia databases, or by checking the latest, say, 100 security advisories from Microsoft TechNet (the management loves Microsoft sources :-) ) or e.g. US-CERT.

Every time there's an exploit for something that was known at the time the exploit took place, that's a vulnerability that patching would have avoided.

A very effective display can be done by installing Secunia Personal on any given computer.

You will almost certainly (I'm not kidding you!) find several vulnerabilities:

  • that can be exploited by a crafted email. That is: every mail they receive could potentially contain the exploit.
  • that can be exploited remotely. That is: connect that laptop to the hotel's WiFi, and more often than not the occupant of any nearby room (in case of workshops abroad, very often a colleague or competitor) can pwn your laptop. Maybe they won't. But they could.
  • that can be exploited remotely on a server. That is: your web site might already be yours no longer. If it has a private area, and maybe sensitive document for the sales force... "How would you like it if some cracker were to leak this information to the highest bidder?".

Just explain to them in layman's terms what exactly a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system could mean for their business.


Patch management is important in order to resolve security vulnerabilities. Known exploits are released for many of these vulnerabilities, and attackers can use these holes to breach your computers. In many cases, anti-virus will never catch it.

The danger is that the patches have already been released, which means that attackers know EXACTLY what's wrong with an unpatched machine. Not patching is like leaving your front door keys under your welcome mat. Sure, you might not know that you have a problem, but how WOULD you know you had a problem?

If you want to confirm the risks, there is software called Metasploit, which is used for just this sort of thing. It contains a large library of pre-built exploits to take advantage of published vulnerabilities. It has a very robust free version.

Take a representative machine, run the Metasploit scanners to identify a vulnerability and run an exploit. See if the AV catches it or not. Chances are that you will be able to easily exploit a machine fairly quickly. An attacker could connect to your network or crack the wifi and do the same thing, or exploit a browser from a web site and use Metasploit to do the same thing using one machine as a launching pad to the rest.

I successfully convinced a 3rd-party vendor to patch their Windows machines simply by showing them a YouTube video of someone using Metasploit to compromise a machine running the same version of Windows they were using.

Patching is low-cost (arguably 'free') and can significantly lower the chance of compromise. This is a no-brainer risk calculation and any resistance you face is based on fear. Make them more afraid NOT to patch than hide from the issue.


I can tell you that Patch Management is high on the list of every IT Auditor and which does get checked quite often. Not patching your systems leaves them vulnerable for the prying eyes of attackers. Patching is required to be done, but it should also be tested before being pushed to production. The only mandatory patches you generally need to do are security patches. Regardless if the system is only LAN or WAN accessible (although WAN needs to be prioritized).

Now you can say "hey what's the risk? We haven't had any issues like that before!". Well in some countries, if you have a breach which leaked personal information and it is shown that you did not take appropriate measures to secure your environment (patch management being one of them) your company can be held legally liable for the breach. In Europe from next year, the new data protection legislation will make it even so that your superiors who are in charge of making policies on how to store this personal information can be personally held liable for this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .