DATASHEETPatch Management Challenges
Survey Results and Insights as Organizations move to Everywhere Workplace
Introduction
Today’s work environments are no longer limited to acontained space where IT-controlled PC workstations
are the center of productivity. Organizations nowadays
are more distributed than ever before, leading tolarger attack surfaces. In the Everywhere Workplace,
employees connect with various devices to accesscorporate networks, data, and services as they workand collaborate from new and different locations, sopatching has never been more challenging.
Meanwhile, IT and security teams are struggling tokeep the constantly widening remote work landscapeunder control. Keeping the new online workspacesafe and up to date with the latest security patches isnecessary but has become increasingly challenging.

ivanti.com

The Challenges
A new study by Ivanti revealed that 71% of IT andsecurity professionals find patching to be overly
complex and time-consuming. As threat actors are
maturing their tactics and weaponizing vulnerabilities,

IT and security professionals said they spend themost time each month on the following activities:
53% - Organizing and Prioritizing Vulnerabilities

especially those with remote code execution,

19% - Issue Resolution for failed patchesorganizations are struggling with attack surface risk

15% - Testing Patches

and ways to accelerate patch and remediation actions.
IT and security professionals simply cannot respondfast enough; 53% of those surveyed said thatorganizing and prioritizing vulnerabilities takes up

10% - Coordinating with other departments
3% - Compliance
1% - Record keeping

most of their time. This is alarming because thelonger vulnerabilities remain unpatched, the more
exposed a business is to the risk of an attack orransomware. However, no organization can patch
all its exposure points and risk-based prioritizationmust be done quickly to keep ahead of automatedadversarial attacks. Today, unpatched vulnerabilities
remain one of the most common points of infiltration
for ransomware attacks, which have increased infrequency and impact to businesses of all sizes.
IT and security teams also spend a lot of theirtime issuing resolutions for failed patches (19%),
testing patches (15%), and coordinating with otherdepartments (10%). The myriad of challenges that IT
and security teams face when it comes to patching
may be why 49% of respondents believe theircompany’s current patch management protocols fail toeffectively mitigate risk.

Patch Management Challenges | DATASHEET2The Causes
A majority (57%) of respondents believe that the global
transition towards a decentralized workspace has madeTo what extent has remote work increased the complexity
and scale of patch management at your organization?

patch management more complex to deal with. The scaleof patch management has also increased with so manydifferent endpoints available to users and the business-53%

critical systems that support them – from Windows tomacOS, Linux to Windows Servers, and more.
And then, some IT systems are difficult to patch because
they cause outages. A daunting 61% of the IT and security

41%

professionals said that they receive requests from line ofbusiness owners to postpone maintenance windows oncea quarter. Another 28% said that they get such requests
once every month.
At the same time, the speed of vulnerability
weaponization continues to increase, especially for
those with the capability of allowing for remote code
execution (RCE). It’s the perfect storm of poor visibility
due to the recent switch to a work from anywhere and thegrowth of threat actors quick to find and use exploitable
vulnerabilities.
Additionally, many organizations lack the security
expertise or time to allow their resources to collect4%2%

threat intelligence and map active exploit threats withthe open vulnerabilities in their organization to achieverisk-based threat context. A shortage of IT staff has
reduced the ability to mitigate security issues promptly

Greatly
Increased

Moderately
Increased

SlightlyEasierHas not
Increased

for many companies. And for organizations such as these,cyberattacks, especially ransomware, have proved to be
the most devastating.
Patch Management Challenges | DATASHEET

3The Threat Landscape
As IT teams struggle to cope with an increased
attack surface, hackers are maturing their tactics
and monitoring where enterprises have vulnerability
exposure risk. They are balancing dogged persistence
and patience with sophisticated use of exploits,
tools, and emerging technology. Their main goal is

Building Trust-Context for Security
and Risk Management
The expanding work landscape and digitaltransformation will continue. However, there needs tobe a way to expand the trust-context for security andrisk management.

to disrupt, steal and act to make monetary gains by

Implementing a Zero Trust framework is paramount for

exploiting enterprise business.

securing sensitive enterprise data from unauthorized

Another survey by Ivanti revealed that 63% of thosesurveyed said their organizations have suffered aransomware attack in the past year. And 89% of
respondents described laptops, desktops, and mobiledevices as the most targeted devices.

access and cyber breaches from attacks. At its
simplest, Zero Trust provides organizations continuous
evaluation of their employee devices, endpoints,and IT and security teams are struggling withto implement a Zero Trust security strategy. Zero Trustprioritizing their patch management efforts so they

security is also a top priority for IT and cybersecurity

can quickly resolve vulnerability risk exposure.

professionals: according to a recent study conducted

remains a prime example, even after four years, of thesevere repercussions that can occur when patches
are not promptly applied. A patch for the vulnerability
exploited had existed for several months before
the initial attack, yet many organizations failed toimplement it. And even today, two-thirds of companies
still haven’t patched their systems. Yet organizations
around the world are still being targeted by WannaCry

prioritize vulnerability weaknesses and to accelerate
remediation effectiveness. The White House recently
released a memo encouraging organizations to use
a risk-based assessment strategy to drive patch
management and bolster cybersecurity against
ransomware attacks. Furthermore, Gartner® listedrisk-based vulnerability management amongst top
security project that security and risk management
professionals should focus on in 2021 to drive
business value and reduce risk.

President Biden signed an Executive Order in May
2021 stating that federal agencies must develop plans

an estimated 200,000 computers in 150 countries,

recommend a risk-based approach to identify andassets, and networks that business relies on.

Hackers are always on the lookout for vulnerabilities

The WannaCry ransomware attack, which encrypted

Top industry leaders, practitioners, and analyst firmsby Ivanti, 98% of North American IT and security
practitioners said that their security practices will
become more aligned with the Zero Trust strategy
over the next year.
Trust-context will look at the risk aspect for thedevices, endpoints, and assets that are used in theEverywhere Workplace. Understanding what levelof vulnerability risk is acceptable and what patches
need to be implemented to meet the business-set

ransomware attacks; there was a 53% increase inrequirements for trust is expected to increase thethe number of organizations affected with WannaCryvalue of risk-based patch management.

ransomware from January to March 2021.

Patch Management Challenges | DATASHEET

4Conclusion
While productivity has increased in the Everywhere
Workplace, threats have also skyrocketed. In thisscattered ecosystem, employees use various
devices to access enterprise data, networks, andapplications to keep working from anywhere, anytime.
These decentralized workstations are more prone

ivanti.com
1 800 982 2130
sales@ivanti.com

to significant threats from bad actors, who arecapitalizing on the sudden shift to a perimeter-lessworkspace and as a conduit to infiltrate organizations.
The Everywhere Workplace demands an approachto security and risk management that continually
evaluates the current context for establishing trustthat is based on active risk-based analysis. With
access to the best vulnerability and patch intelligencethat includes active vulnerability exploits in the wild,
vulnerabilities with ties to ransomware, sentiment
data on patch reliability, Ivanti is expanding the toolsthat IT and security teams can seamlessly deploy andimprove the effectiveness of the security and risk
management of their organization.
For more information, check out our blog and registerfor the Ivanti Patch Tuesday webinar series. And listen
to the Ivanti Insights podcast, “The Next Evolution ofPatch Management: Don’t Try to Patch Everything!”

1.

Copyright © 2021, Ivanti. All rights reserved. IVI-2634 10/21 MM/FG

i. Smarter with Gartner, Gartner Top 10 Security Projects for
2020-2021, February 22, 2021
2. ii. GARTNER is a registered trademark and service mark ofGartner, Inc. and/or its affiliates in the U.S. and internationallyand is used herein with permission. All rights reserved.