As reported software vulnerabilities are reaching record levels, IT teams are grappling with the ongoing grind of keeping endpoints patched and up-to-date. Recent reports detail that while some attacks rely on newly discovered exploits, 50 percent of attacks target vulnerabilities reported before 2017. The never-ending cycle of discovered exploits and the ongoing time, resources and employee hours used to deploy patches to devices places a considerable burden on staff aiming to enhance organizational security. Automated patch management would free up team members to focus on more critical vulnerabilities, but organizations may find that getting to that point may be a bit more challenging than expected.

I was inspired by a thread started by Cathy Click, head of Security Awareness at FedEx. She asked a fantastic and inspiring question, what would the perfect Security Awareness / Culture team look like? If I truly wanted to manage my organization’s human risk, who would I need to manage that effort? I felt this was a fantastic question and wanted to share my perspective. I fully realize not all organizations have the resources to support such a diverse team I describe below, but this is something I would love to see organizations strive for.

Think about your API assets like you would books in a library. Can someone come in and easily find the genre they want? When they find a book they’re interested in, can they flip through it for more information? When they’re ready, is it a straightforward process for them to check out?