OS and software patching

Current org is very risk-averse in regards to web-apps... so risk averse that they choose NOT to patch fairly often, because availability is more important than anything else. I have tried, without success, to argue that availability is compromised where vulnerability exists.


In other positions I've held, applying ***security*** ***patches*** of nearly any severity within 30 days was a requirement, without exception. Currently, Getting patches into production takes about 6 weeks... So prod is a minimum 6 weeks behind, and …

apps availability compromised current cybersecurity important org patch patches patching risk security severity software software patching vulnerability web