Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW
  • CPE

Risk-Based Patch Prioritization and Remediation Strategies

Ivanti
09/29/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


is this vulnerability? Well, the fact of the matter is, the majority of the time, that's not the vulnerabilities that you really need to be concerned about. So most of the vulnerabilities that are actively being targeted are not the ones that we're prioritizing response to. This is where getting into more of a risk-based approach to prioritization is required to be able to keep up with that. The remediation cycle is the other important part of this. We need to be able to respond to the higher priority items first. More importantly, though, we have to be able to respond to different tracks of remediation items in parallel. So really what we're ending up with is, call it three different tracks of remediation. My normal routine maintenance that happens once a month, doesn't matter what my SLA is, the priority updates, things like the browser updates or communications applications like Zoom and other things like that, that users are using typically are more highly targeted and need to be responded to on a more frequent basis. And then that zero-day response track. If I've got everything configured properly, all of the updates that come out continuously doesn't matter which type they are, all fall into one of those three priorities and get taken care of in the course of my regular activities that are configured within the systems I'm using.

TL;DR

  • Vendor-assigned severity ratings often fail to identify the vulnerabilities that attackers are actually targeting, creating a dangerous prioritization gap.
  • Risk-based prioritization aligns remediation efforts with real-world threat activity rather than theoretical severity scores.
  • A three-track remediation model—routine maintenance, priority updates, and zero-day response—enables parallel processing of different vulnerability types.

Summary

This brief explainer challenges the conventional approach to vulnerability management, arguing that organizations often misprioritize patches by relying solely on vendor-assigned severity ratings. The speaker contends that most actively exploited vulnerabilities are not the ones receiving immediate attention under traditional prioritization models. Instead, a risk-based approach is essential for aligning remediation efforts with actual threat activity. The video introduces a three-track remediation framework: routine monthly maintenance for standard updates, priority updates for frequently targeted applications like browsers and communication tools such as Zoom, and a dedicated zero-day response track for critical emerging threats. When properly configured, this parallel processing model ensures that all updates automatically flow into the appropriate priority track and are addressed through regular operational workflows. The approach emphasizes that effective patch management requires both smarter prioritization based on real-world exploitation data and the operational capability to handle multiple remediation streams simultaneously.

Chapters

0:00 - The Prioritization Problem
0:23 - Risk-Based Approach
0:32 - Three-Track Remediation Model

Key Quotes

0:09 "The fact of the matter is, the majority of the time, that's not the vulnerabilities that you really need to be concerned about."
0:16 "Most of the vulnerabilities that are actively being targeted are not the ones that we're prioritizing response to."
0:23 "This is where getting into more of a risk-based approach to prioritization is required to be able to keep up with that."

FAQ

Why shouldn't organizations rely solely on vendor severity ratings for patch prioritization?

Vendor severity ratings reflect theoretical risk, not real-world exploitation. The speaker notes that most actively targeted vulnerabilities are not the ones receiving priority response under traditional models, meaning organizations may be patching lower-risk items while leaving exploited vulnerabilities unaddressed.

What are the three remediation tracks recommended in this approach?

The framework includes routine monthly maintenance for standard patches, a priority track for frequently targeted applications like browsers and Zoom that need more frequent updates, and a zero-day response track for critical emerging threats requiring immediate action.


Categories:
  • » Webinar Library » Ivanti
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Vulnerability Management
  • Best Practices
  • Security Operations
  • Risk-based vulnerability prioritization
  • Patch management strategy
  • Remediation workflows
  • Zero-day response
  • Vulnerability management
  • Security operations
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Risk-Based Patch Prioritization and Remediation Strategies

              How secure is your Microsoft enterprise? Under 5 minutes, earn $10 in TruthPoints.

              View CPE Certificates

              Upcoming 360 View Events

              • Nov
                19

                Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Dec
                  09

                  Beyond Continuous Compliance: Getting Ready to Detect, Recalculate, and Adapt

                  12/09/202601:00 PM ET
                  More events

                  Industry Events (Sponsor Hosted)

                  • Nov
                    18

                    Hands-On Workshop: Connecting On-Prem Data to Databricks via MinIO AIStor (International)

                    11/18/202608:00 AM ET
                    • Nov
                      19

                      Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

                      11/19/202601:00 PM ET
                      • Nov
                        19

                        AI Agent Showdown: Discover What Muse, Dots, and Duet Bring to Your Website

                        11/19/202601:00 PM ET
                        • Dec
                          02

                          Skylight en acción: salvaguardando la IA más allá del usuario.

                          12/02/202604:00 AM ET
                          • Dec
                            03

                            CISO Insights: Steering Cybersecurity Strategies in an AI-Driven Era

                            12/03/202601:00 PM ET
                            More events

                            Upcoming Webinar Calendar

                            • 11/18/2026
                              08:00 AM
                              11/18/2026
                              Hands-On Workshop: Connecting On-Prem Data to Databricks via MinIO AIStor (International)
                              https://www.truthinit.com/index.php/channel/2194/hands-on-workshop-connecting-on-prem-data-to-databricks-via-minio-aistor-international/
                            • 11/19/2026
                              01:00 PM
                              11/19/2026
                              Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection
                              https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
                            • 11/19/2026
                              01:00 PM
                              11/19/2026
                              AI Agent Showdown: Discover What Muse, Dots, and Duet Bring to Your Website
                              https://www.truthinit.com/index.php/channel/2228/ai-agent-showdown-discover-what-muse-dots-and-duet-bring-to-your-website/
                            • 11/19/2026
                              01:00 PM
                              11/19/2026
                              Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents
                              https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
                            • 12/02/2026
                              04:00 AM
                              12/02/2026
                              Skylight en acción: salvaguardando la IA más allá del usuario.
                              https://www.truthinit.com/index.php/channel/2147/skylight-en-acción-salvaguardando-la-ia-más-allá-del-usuario/
                            • 12/03/2026
                              01:00 PM
                              12/03/2026
                              CISO Insights: Steering Cybersecurity Strategies in an AI-Driven Era
                              https://www.truthinit.com/index.php/channel/2231/ciso-insights-steering-cybersecurity-strategies-in-an-ai-driven-era/
                            • 12/09/2026
                              01:00 PM
                              12/09/2026
                              Beyond Continuous Compliance: Getting Ready to Detect, Recalculate, and Adapt
                              https://www.truthinit.com/index.php/channel/2250/beyond-continuous-compliance-getting-ready-to-detect-recalculate-and-adapt/
                            • 12/09/2026
                              02:00 PM
                              12/09/2026
                              Strategies for Safeguarding Endpoints in the Agentic Era with Cyera
                              https://www.truthinit.com/index.php/channel/2256/strategies-for-safeguarding-endpoints-in-the-agentic-era-with-cyera/
                            • 12/17/2026
                              01:00 PM
                              12/17/2026
                              Truth in IT Alpha Test: New chat system
                              https://www.truthinit.com/index.php/channel/2265/truth-in-it-alpha-test-new-chat-system/
                            • 01/19/2027
                              04:00 AM
                              01/19/2027
                              Skylight in Aktion: Gewährleisten Sie KI-Schutz über den Benutzer hinaus
                              https://www.truthinit.com/index.php/channel/2176/skylight-in-aktion-gewährleisten-sie-ki-schutz-über-den-benutzer-hinaus/
                            • 01/19/2027
                              02:00 PM
                              01/19/2027
                              HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.
                              https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
                            • 03/18/2027
                              01:00 PM
                              03/18/2027
                              Securing Access for People, Partners and AI Agents
                              https://www.truthinit.com/index.php/channel/2251/securing-access-for-people-partners-and-ai-agents/
                            • 06/17/2027
                              01:00 PM
                              06/17/2027
                              Stop the Leak: Data Loss Prevention for the AI Era
                              https://www.truthinit.com/index.php/channel/955/360view-stop-the-leak-data-loss-prevention-for-the-ai-era/
                            • 08/19/2027
                              01:00 PM
                              08/19/2027
                              Who Has Access to What...and Should They?
                              https://www.truthinit.com/index.php/channel/2252/who-has-access-to-what-and-should-they/
                            • 10/21/2027
                              01:00 PM
                              10/21/2027
                              After VMware: Building the Private Cloud You Actually Want
                              https://www.truthinit.com/index.php/channel/2253/after-vmware-building-the-private-cloud-you-actually-want/
                            • 11/18/2027
                              01:00 PM
                              11/18/2027
                              Assume Breach, Prove Recovery
                              https://www.truthinit.com/index.php/channel/2254/assume-breach-prove-recovery/
                            • 12/16/2027
                              01:00 PM
                              12/16/2027
                              The Self-Running Service Desk
                              https://www.truthinit.com/index.php/channel/2255/the-self-running-service-desk/
                            Truth in IT
                            • Sponsor
                            • About Us
                            • Terms of Service
                            • Privacy Policy
                            • Contact Us
                            • Preference Management
                            Desktop version
                            Standard version