Learn · Guide · 5 min read

Fix what attackers can reach first

Patch tools can list hundreds of vulnerabilities. Most small IT teams can’t work through all of them, and they don’t need to. Start with what an attacker can actually reach.

Why the long list is mostly noise

Vulnerability feeds for Windows, Microsoft 365 and browsers include many flaws that only matter once an attacker is already on the computer or at the keyboard: local privilege escalation, issues triggered by opening a crafted file, bugs in features you don’t use. They deserve patching, but reading each alert one by one burns time that should go to bigger risks.

What to put first

• Services reachable from the network or the internet. An exposed remote desktop, database or admin page can be attacked from across the room or across the world, with no user action needed.
• Software with vulnerabilities attackers are using now. CISA’s Known Exploited Vulnerabilities catalog lists flaws seen in real attacks. A reachable service on one of those versions is the most urgent kind of finding.
• Changes that close a door. Turning off an old protocol or restricting an exposed port often removes more risk than dozens of individual laptop patches.

Two different kinds of vulnerability data

Endpoint tools such as Microsoft Defender look inside each computer: installed browsers, Office, PDF readers and Windows updates. A network scanner like Torva looks at what answers on the network: web servers, remote desktop, SSH, databases, printers and device admin pages, and the software versions they report. The two lists barely overlap. Torva won’t reduce endpoint alerts, and endpoint alerts won’t tell you a database port is open to the internet. You need both views, but only one of them needs a person working through it each week.

Split the work in two

The active list. Treat exposed services and actively exploited software as your to-do list, and fix those items promptly. Torva builds this list for you: it checks what’s reachable from outside (Edge) and inside your network (Core), reports only what is reachable over the network, groups findings by the change that fixes them, and puts anything on CISA’s exploited list at the top.

The automated baseline. Put Windows and Microsoft 365 on scheduled, automatic updates through your patch management tool, such as Windows Update for Business or Intune, and check that updates are installing. Routine fixes then arrive without anyone reading each alert. Torva doesn’t replace this; it doesn’t log in to devices or inventory installed patches.

Keep the active list short

Some findings are fine once checked: remote desktop that already requires MFA through a gateway, or a vendor-locked medical device on an isolated network. In Torva you can sign these off as Verified or Risk accepted, with a reason and a review date. They move out of the to-do list into a one-line summary, and come back automatically if a new device shows the same problem, the severity rises, the software version changes or the review date passes. The record of who signed off, when and why also documents your risk decisions for a HIPAA risk analysis.

For a weekly routine built on this approach, see the 20-minute weekly security review.

---