Bad Cyber Hygiene: 60 Percent of Breaches Tied to Unpatched Vulnerabilities

Bad cyber hygiene remains a one-way ticket to getting breached. Research consistently shows that unpatched vulnerabilities are directly responsible for up to 60 percent of all data breaches.

In a surprising number of cases, organizations actively scan for vulnerabilities, but their patch management solutions fall short of full coverage. Cybersecurity talent shortages affect every industry from finance to education, making automation essential.

Summary: Unpatched vulnerabilities cause approximately 60 percent of data breaches because organizations delay patches to avoid business disruptions. Over 80 percent of security leaders have discovered patches they thought were deployed had failed to reach all endpoints. Automated patch management provides real-time visibility and consistent deployment across all devices to close these security gaps.

Research from industry sources finds that unpatched vulnerabilities are a primary driver of data breaches. In 2024 reports, 60 percent of organizations that experienced a data breach cited a known, unpatched vulnerability as the root cause.

The number of security professionals who forgo patching to avoid disrupting the workplace is staggeringly high. Over 80 percent say they have postponed a patch for this reason at least once.

Another 80 percent of CIOs and CISOs report being shocked to discover that a patch they thought had been deployed across their entire network had not actually updated all devices. This left multiple endpoints vulnerable without anyone knowing.

Even when organizations conduct vulnerability scans, what they do with the information varies widely. Many security teams report that unpatched vulnerabilities contributed to breaches within their organizations despite active scanning programs.

With a one-in-four chance that one of your vulnerabilities may be exploited before you get around to patching it, the risk calculation is clear. The average cost of a data breach in 2024 reached $4.88 million according to IBM, and breach costs continue to rise year over year.

Recent high-profile breaches illustrate the danger. The MOVEit Transfer vulnerability exploited in 2023 affected over 2,700 organizations and exposed data of approximately 93 million individuals. The Progress Software flaw had patches available, but many organizations failed to deploy them in time.

Survey data suggests that a staggering number of security professionals simply opt to delay action. Patch management is a complex process that can take significant time, especially when done manually.

Approximately 81 percent of CIOs and CISOs say they elect to delay putting patches through to avoid interrupting the flow of business. Most also report postponing patches on more than one occasion.

Another 94 percent of IT professionals say they make compromises in how they protect their organization from cyber threats. Many of these compromises stem from trouble maintaining visibility over endpoints, containers, and servers.

Lack of visibility is so prominent that over 80 percent of CIOs and CISOs surveyed found critical updates they thought had been deployed had not actually updated all devices. This left their business exposed as a result.

Poor visibility over endpoints is a major problem, even for experienced security professionals. Eight out of every ten security leaders report that their patches are not actually deploying across the entire network. They may not discover this failure until after an incident occurs.

Tech professionals must also contend with other business units who may not understand the importance of patching vulnerabilities. This leads to delayed patch management and gaping holes in any cyber hygiene regimen.

Automated patch management systems help IT professionals streamline patch deployment, increase endpoint visibility, and provide real-time vulnerability status updates. Through automation, status reporting becomes straightforward across the entire environment.

Paul Norris, senior systems engineer EMEA at Tripwire, notes that compromising on security may be cost-effective short term, but could lead to much more serious business disruptions than maintaining a consistent patching routine.

Cyber hygiene should be a top priority for every business. Follow these steps to strengthen your patching posture:

• Conduct a complete endpoint inventory across all operating systems and locations

• Implement automated vulnerability scanning on a continuous basis

• Deploy an automated patch management solution with real-time visibility

• Establish patch deployment SLAs based on vulnerability severity

• Create exception processes for delayed patches with documented risk acceptance

• Monitor patch compliance dashboards daily

While cybersecurity may be considered a newer discipline, the art of exploiting vulnerabilities is not. If you do not maintain proper cyber hygiene, attackers will find and exploit those gaps.