Businesses and agencies today are spending an average of about 250 days to remediate high-severity risks, NTT Application Security found.

This length of time gives attackers nearly a year in the target network. From there, they can misuse security weaknesses for gaining a foothold and/or moving within the network to other assets.

Read on to understand what factors make it take so long to remediate problems.

Nearly a Year at a Time to Remediate

Researchers found that the average time needed to fix vulnerabilities grew from 197 days to 202 days over the first half of 2021, said the report.

The window was even greater for high-severity vulnerabilities. It took 194 days at the beginning of the year to fix those types of flaws. By the end of June, it took 246 days.

These lengths of time could explain the decrease in remediation rates observed by the study. For critical vulnerabilities, the standard dropped from 54% in January 2021 to 48% six months later. The rate for high-severity vulnerabilities fell even more in H1 2021 from 50% to 38%.

Where Network Security Comes In

The findings discussed above in part reflect how the shift to remote work increased network complexity for many groups.

In a 2021 study covered by Axonius, for instance, most (55%) of respondents cited remote work as a driver of increased complexity. That’s up from 27% a year earlier.

Remote work introduced new device connections onto the corporate network and physically separated IT and security teams from device owners. Together, those two changes made it more difficult for team members to discover, manage and interact with assets. That, in turn, makes it harder to remediate known problems on a timely basis.

It’s unclear how long businesses and agencies will need to account for those challenges. To illustrate, Gartner wrote in 2020 that 82% of company leaders planned on allowing their employees to work remotely at least some of the time going forward. This will require IT and security teams to adjust their vulnerability remediation efforts.

How to Remediate Vulnerabilities More Effectively

Organizations can work to close the vulnerability remediation gaps detailed above by focusing on security basics. First, they need to confirm that they can build a dynamic inventory of their hardware and software assets. Such a list enables teams to monitor their authorized assets for known vulnerabilities.

Second, they need to track for weaknesses in the context of a risk-based vulnerability management program. It’s not enough to know a vulnerability exists. They need to understand the risk it poses to the business. That way, they can prioritize and remediate or mitigate it.

Not all organizations have the right experience to build an asset inventory and a risk-based vulnerability management program across their entire IT infrastructure. If that’s the case, they can consider using a vulnerability assessment solution that conducts thousands of vulnerability assessment tests across their hybrid and multi-cloud environments. This prescribes ways through which they can fix any issues it may discover, reducing the time to spend dealing with attacks.

More from News

Securing critical infrastructure with the carrot and stick

4 min read - It wasn’t long ago that cybersecurity was a fringe topic of interest. Now, headline-making breaches impact large numbers of everyday citizens. Entire cities find themselves under cyberattack. In a short time, cyber has taken an important place in the national discourse. Today, governments, regulatory agencies and companies must work together to confront this growing threat. So how is the federal government bolstering security for critical infrastructure? It looks like they are using a carrot-and-stick approach. Back in March 2022, the…

650,000 cyber jobs are now vacant: How to tackle the risk

4 min read - How far is the United States behind in filing cybersecurity jobs? As per Rep. Andrew Garbarino, R-N.Y., Chairman of the HHS Cybersecurity and Infrastructure Protection Subcommittee, overseas adversaries have a workforce advantage over FBI cyber personnel of 50 to one. His statements were made during a recent subcommittee hearing titled “Growing the National Cybersecurity Talent Pipeline.” Meanwhile, recent CyberSeek data shows over 650,000 cyber jobs to fill nationwide. Given the rising rate of cyberattacks, these numbers are truly alarming. How…

Will data backups save you from ransomware? Think again

4 min read - Backups are an essential part of any solid anti-ransomware strategy. In fact, research shows that the median recovery cost for ransomware victims that used backups is half the cost incurred by those that paid the ransom. But not all data backup approaches are created equal. A separate report found that in 93% of ransomware incidents, threat actors actively target backup repositories. This results in 75% of victims losing at least some of their backups during the attack, and more than…

Should you worry about state-sponsored attacks? Maybe not.

4 min read - More than ever, state-sponsored cyber threats worry security professionals. In fact, nation-state activity alerts increased against critical infrastructure from 20% to 40% from 2021 to 2022, according to a recent Microsoft Digital Defense Report. With the advent of the hybrid war in Ukraine, nation-state actors are launching increasingly sophisticated attacks. But is this the most prominent danger facing companies today? While nation-state-based attacks cannot be ignored, it looks like insider cyber incidents are far more common. In fact, for the…