Closing the Loop Between Vulnerability Scans and Patching: A Practical Four-Step Cycle

Most organizations I visit already have a vulnerability scanner and some way to install updates. What they rarely have is a loop that connects the two: the scanner reports, IT patches, and the same findings come back next month.

At one organization with about eight hundred computers and six branch offices, the monthly scan report ran to two hundred pages. WSUS handled Windows updates, but browsers, Java and PDF software were months behind. Two branches had not been patched for four months, because downloading updates saturated their links. And a sales manager's unencrypted laptop had been left in a taxi.

A cycle that closes the loop

1. Find accurately: run credentialed scans so the real version of every application is visible.

2. Prioritize by real risk: start with actively exploited vulnerabilities on exposed or sensitive systems, not "every critical."

3. Deploy from the console already on the devices: OS and third-party patches from one place, scheduled for off-hours, with a local patch cache in each branch.

4. Verify with the next scan: a finding is closed only when the next scan no longer sees it.

Do not forget disk encryption

Central management of BitLocker and FileVault, with recovery keys stored in the console rather than on paper, closes the lost-laptop risk. Rehearse key recovery with the help desk before rolling it out widely.

The numbers worth tracking

The Verizon 2025 DBIR found that exploitation was the initial access vector in 20% of breaches, and that only 54% of the edge-device and VPN vulnerabilities it examined were fully remediated during the year, with a median of 32 days. I suggest reporting just two metrics every week: median days to remediate and the percentage of up-to-date devices per branch. Track firewalls and VPN appliances separately; workstation patching tools do not touch them.

Where to start

If none of this is in place today, start small: turn on credentialed scanning, pilot a group of fifty devices and one branch, and measure the result with the same two metrics. In week three, start encrypting high-risk laptops; in week four, run a verification scan. Thirty days is enough to see the difference.

After two months, the recurring findings in that organization's monthly report fell to less than a quarter.

The full guide, with five common mistakes and a 30-day rollout plan, is here: Patch management and disk encryption from the security console

— Kazem Mortazavi, independent network-security consultant