Kevin BeaumontKonto zweryfikowane

When critical application patching doesn't happen at a F1000 company, 9/10 says the blame lies with leadership, not Joe or Sue admin.

It is not the responsibility of the CIO or CISO to know tech specifics of every vuln. It is their responsibility to manage risk & people.

They create the policies, hire competent people to provide them reports, and monitor projects and operations.

They also have a critical role to play in advocating for bringing the critical systems down for maintenance, nose to nose with angry execs.

A CIxO does not need to be a CS major or a former engineer. They need to be a great manager and politician, who knows solid fundamentals.

In conclusion, nearly anything short of malicious insider or absolute technical incompetence, patches not happening is on leadership.