)
Yesterday, I recorded a webinar exploring how organizations can keep pace with patching and mitigating an unprecedented volume of vulnerabilities. Last night, Automox, along with the rest of the internet software world, learned of two critical PHP code execution vulnerabilities.
The webinar anchors on the idea that speed is a governance problem. And that more tools don’t mean lower risk. That paradox shows up in recent survey data: while 69% describe their endpoint ops as very mature and 81% say they’re highly automated, 92% also say they need three months to create repeatable workflows. And 0% — none — say they can deploy emergency patches within hours.
The fundamental gap is governance and preparation. Last night tested Automox’s internal governance and preparation. We had done the work before the emergency to define boundaries. We had a process, clear decision-making authority, and articulated risk thresholds. Because of that preparation, we executed quickly and quietly to mitigate last night and remediate this morning.
Like any business, we are dependent on our people, but our governance is designed to work even if we have some new faces or some folks out. Our people are professional, diligent, capable, and trusted, but when time is of the essence and execution is critical, they follow a visible, defined process. That’s what helps them go fast with confidence. Governance doesn’t slow them down. It speeds them up.
Yes, our people have the tools. That goes without saying. But governing those tools (using technology to automate toil, people to codify good judgment before the emergency, and outcome verification as the ultimate measure of success) is what helped me sleep well last night.
I appreciate the serendipity of yesterday’s webinar content manifesting over the last 14 hours of vulnerability response. Because of diligent preparation and well-governed workflows, we could quickly and confidently mitigate our risk. Like it or not, vulnerability volume and velocity are only getting worse. Now is the time to prepare and govern. Before there’s an emergency.