Source: CISOs step into the AI spotlight | CSO Online
Author: unknown
URL: https://www.csoonline.com/article/4169623/why-patching-slas-should-be-the-floor-not-the-strategy.html
ONE SENTENCE SUMMARY:
Patching SLAs create compliance theater by rewarding easy fixes, while true cyber risk persists in hard-to-remediate legacy, architecture, and control gaps.
MAIN POINTS:
- CISOs often recite green SLA metrics while significant unresolved vulnerabilities remain.
- Quickly closed criticals are typically inexpensive, low-friction remediation tasks.
- Difficult issues linger: legacy systems, architectural flaws, identity misconfigurations, and unsupported platforms.
- Governance and reporting overemphasize SLA compliance, masking concentrated high-impact exposures.
- SLA performance indicates ticketing discipline, not actual security risk reduction.
- Fire-drill analogy: repeated success doesn’t prove resilience against unscripted incidents.
- Boards can be misled when the riskiest failures live inside the “small” noncompliant percentage.
- Expressing cyber risk in dollar terms changes executive prioritization and funding discussions.
- Exception processes often become paperwork, letting exposure disappear from dashboards without mitigation.
- Meaningful remediation needs capital/opex investment justified by quantified risk reduction.
TAKEAWAYS:
- Reframe SLAs as minimum hygiene requirements, not primary vulnerability program success metrics.
- Prioritize trending quantified residual risk by business service over raw closure percentages.
- Require risk acceptances to include loss exposure, review cadence, and funded remediation plans.
- Use attacker-speed evidence (e.g., DBIR, KEV) to challenge long patch timelines for hard changes.
- Accept imprecision in CRQ estimates because actionable dollars beat misleading green scorecards.