Insights from Kevin Walker and Heimdal Cyber Security Advisor, Adam Pilton.
Many cyber attacks rely on complex techniques and advanced tools.
But a surprising number begin with something far simpler.
An unpatched vulnerability.
A system running an operating system that is no longer supported.
Or software that hasn’t been updated in months.
These weaknesses provide an opportunity for attackers to gain access without needing to guess passwords or trick staff with phishing emails.
Keeping systems supported and updated remains one of the most effective ways to reduce this risk.
I recently discussed this topic with Adam Pilton, Cyber Security Advisor at Heimdal and former Cyber Essentials Plus assessor.
Adam has spent years assessing organisations against Cyber Essentials and repeatedly saw the same issue: businesses often had far more vulnerabilities across their systems than they realised.
That gap between what organisations think is patched and what actually is patched creates an opportunity attackers actively look for.
What happens when software isn’t updated
Software vulnerabilities are discovered regularly.
Sometimes they are identified by security researchers.
Sometimes by the vendors themselves.
When a weakness is discovered, the software developer releases an update that fixes the issue.
Once that update becomes public, something important happens.
The vulnerability becomes known to everyone.
Including attackers.
From that moment on, organisations that delay patching are effectively leaving the vulnerability open.
Attackers know exactly where to look.
How cyber criminals exploit vulnerabilities
Modern cyber attacks often rely heavily on automation.
Attackers run large-scale scans across the internet looking for systems that match known vulnerabilities.
These scans can identify:
outdated web servers
unsupported operating systems
missing security patches
exposed services
Once a vulnerable system is identified, automated tools can attempt exploitation.
In many cases this process requires very little manual effort.
If the vulnerability is exploitable and the system has not been updated, attackers may gain access within minutes.
Why vulnerability management is considered a foundational control
As Adam explains:
“Unpatched vulnerabilities can give attackers a direct way into our systems. Vulnerability management exists to identify and fix these weaknesses before they can be used by cyber criminals, which is why it is treated as a foundational security control and is featured in standards such as Cyber Essentials.”
A well-known example of this was the MOVEit breach in 2023.
MOVEit software is widely used by organisations to transfer sensitive information between systems, including payroll data, patient records and government documents.
Multiple vulnerabilities were discovered in the MOVEit platform. Attackers exploited these weaknesses to gain access to MOVEit databases. Once inside, they were able to create accounts, delete accounts and extract sensitive data from affected organisations.
A patch was released to fix the issue.
However, the critical factor became the time between the vulnerability being discovered and organisations applying the patch.
Adam added:
“Organisations that do not have effective vulnerability management in place, or are simply slow to apply updates, leave a larger window of opportunity for attackers to exploit these weaknesses.”
The risk of unsupported operating systems
One of the biggest risks comes from operating systems that have reached end of support.
When an operating system is no longer supported by its vendor, security updates stop being released.
That means newly discovered vulnerabilities remain permanently unpatched.
Over time these systems become increasingly exposed as new weaknesses are discovered.
This is one of the reasons frameworks such as Cyber Essentials require organisations to run supported operating systems and apply security updates regularly.
Without vendor support, maintaining a secure environment becomes extremely difficult.
It’s not just the operating system
Operating system updates are important, but they are only part of the picture.
Many attacks exploit weaknesses in third-party software, including:
web browsers
document readers
remote access tools
backup software
server applications
browser plugins
If these applications fall behind on updates, they can create additional entry points into the environment.
In many organisations these tools are installed over time and gradually forgotten.
Without good visibility, it becomes difficult to know what actually needs patching.
Why visibility is essential
A common problem Adam encountered while working as a Cyber Essentials Plus assessor was that many organisations simply didn’t realise how many vulnerabilities existed across their environments.
“During that time I worked with many organisations and repeatedly found the same issue. Many had large numbers of vulnerabilities across multiple devices and were completely unaware of them.”
Attackers, however, are actively looking for these weaknesses.
Many vulnerabilities can be discovered using automated scanning tools and public vulnerability databases.
If organisations are not actively identifying and fixing these issues, attackers may find them first and use them as an entry point into the network.
Patching reduces the attack surface
Keeping systems updated does not eliminate cyber risk entirely.
Attackers will always look for new techniques and new weaknesses.
However, patching removes a large number of the most common opportunities attackers rely on.
By reducing the number of exploitable vulnerabilities, organisations significantly reduce their attack surface.
In simple terms, it becomes much harder for attackers to find an easy way in.
The challenge for many organisations
In practice, patching is often more difficult than it sounds.
Organisations frequently face challenges such as:
systems that cannot easily be restarted
software compatibility concerns
devices that are rarely connected to the network
uncertainty about which updates are safe to apply
Over time these delays allow vulnerabilities to accumulate.
Without a structured approach to patching and vulnerability management, organisations may not realise how many weaknesses exist.
A practical approach to reducing risk
A strong vulnerability management strategy typically includes:
keeping operating systems within supported versions
applying security updates regularly
monitoring for newly discovered vulnerabilities
maintaining visibility over installed software
ensuring critical systems are patched quickly
Standards such as Cyber Essentials and SMB1001 place vulnerability management at the centre of their security guidance for small organisations.
The goal is simple.
Identify weaknesses early and fix them before attackers exploit them.
Understanding your current exposure
Many organisations assume their systems are fully up to date.
In reality, security assessments often reveal missing patches, outdated applications, or unsupported systems still in use.
Identifying these issues early allows them to be addressed before they become a problem.
At Black Swan Cyber Security Solutions, we regularly help organisations review their environments and identify where vulnerabilities may exist.
Sometimes the findings are reassuring.
Other times they highlight areas that need attention.
Either way, understanding where weaknesses exist is the first step towards reducing cyber risk.
Need help keeping systems supported and updated?
For many organisations, patching sounds simple in theory but becomes much harder in practice.
Devices are switched off.
Servers can’t easily be rebooted.
Applications have dependencies.
And new vulnerabilities appear every week.
Without good visibility, it’s easy for systems and software to fall behind on updates.
Using tools such as Heimdal Patch & Asset Management, we can:
identify outdated operating systems and unsupported devices
detect missing security updates across the network
keep third-party applications up to date
maintain a clear inventory of software and assets
reduce the number of exploitable vulnerabilities in your environment
Combined with frameworks such as Cyber Essentials and SMB1001, this approach helps organisations take a more structured and proactive approach to cyber security.
If you’re unsure whether every system and application in your environment is still supported and fully patched, it may be worth taking a closer look.
A short review can often highlight issues that are quick and straightforward to fix – before someone else finds them first.
