Attackers automate scans for known holes. Leaving an internet-facing VPN or mail server unpatched days after a critical CVE is high risk; internal-only apps can wait for a maintenance window.
Maintain an inventory: what runs, what is exposed (public IP, port forward, cloud control plane), who owns it. Without a list, “we patch regularly” becomes random clicking.
CVSS, exploits, and what “critical” means to you
CVSS scores help triage, but your priority is whether the service is reachable from the internet and whether public exploits exist. The same RCE might wait on an internal print server behind a firewall but not on a public443 reverse proxy.
Many teams subscribe to vendor advisories and run internal SLAs — e.g. patch critical edge systems within 24–72 hours of a fixed release unless a compensating control is in place.
Process over panic
Tier severities: immediate hotfix (internet RCE), 7 days, 30 days, planned app release. Test before ERP changes — but public edge proxies rarely get a month of QA; use WAF rules plus fast patching.
Auto-updates on endpoints and managed SaaS reduce debt; for custom code, use dependency scanners and regular builds. Air-gapped networks need a deliberate transfer process for patches.