Do you know what’s exposed and who’s fixing it?

As Head of Technical Delivery at Nviron, I want organisations to be able to answer three straightforward questions: what is exposed, who owns it, and how do we know it has been secured? 

For myself, recent security announcements reinforce why patching and visibility belong on the business agenda. Vulnerable applications and perimeter infrastructure can put essential services, data and credentials at risk. 

My concern with AI-assisted tools is what they can make possible: helping attackers analyse software and code, including legacy systems, and explore how weaknesses might be combined. The practical response is to understand your exposure and assess relevant security advisories promptly. 

There is a defensive side to this too. AI-assisted research can help vendors identify weaknesses and develop patches and hardening guidance. But I would not take that as reassurance that fixes will always arrive before attacker’s act. We still need to assess advisories promptly and coordinate remediation. 

My approach is to assess vendor security releases promptly, then prioritise remediation by affected versions, exposure, evidence of exploitation and business impact. Internet-facing devices and services deserve particular attention. Urgency should not mean losing control of the change: recovery arrangements and post-change verification still matter. 

How to protect?

I would start with the applications, hardware and software-as-a-service (SaaS) platforms your business depends on. What data and authentication do they handle, and which services can be reached from the internet? That gives you a practical starting point for understanding the impact of a compromise. 

For me, an inventory only becomes useful when each service has an accountable owner and remediation is prioritised by exposure and business impact. If a supplier manages the platform, ask who applies security updates and what evidence you will receive. For systems you manage, record the action, owner and target date. 

You do not have to tackle every part of this alone. Where capacity or specialist expertise is limited, a security partner such as Nviron can help assess exposure, agree priorities and coordinate support. What matters to me is that responsibilities and response arrangements are clear, so urgent actions have an owner. 

Is my service published correctly?

When I look at a published service or SaaS platform, my first question is simple: who actually needs access? Does it need to be available to everyone, or only to a defined group of users? 

I would challenge the need for direct public access rather than assume it is necessary. Each public-facing service should have a clear reason to be exposed. 

That is where Zero Trust Network Access (ZTNA), appropriately configured VPN access and multi-factor authentication can help. They give us ways to reduce unnecessary exposure and limit access to authorised resources and services. 

Where public access is not needed, I would look at removing the exposure or restricting access through an appropriate private-access solution, such as ZTNA. The approach still needs to work for legitimate users and integrations. I would also be clear about its limits: access controls complement patching and monitoring; they do not replace them. 

How Nviron can help 

At Nviron, we can help coordinate security management and visibility across perimeter and endpoint environments through our security portfolio and service teams. I believe that starts with a shared understanding of the systems covered, the work we will undertake and the responsibilities that remain with your organisation and other suppliers. 

My aim is to make the next steps clear, not leave you with another list of concerns. Depending on the services we agree, we can support you in the following areas: 

• Understand your exposure. We can use infrastructure assessments to review patch and firmware status, support lifecycles and configuration. This helps us identify gaps and agree remediation priorities with you for the systems assessed. 

• Coordinate controlled security updates. Through agreed managed patching and network services, we can support operating-system updates and firewall, switch and access-point firmware changes for covered assets. We need to agree urgent changes, service impact and validation with the relevant owners. I would not assume that application runtimes or supplier-hosted services are included in infrastructure patching; their ownership needs to be explicit. 

• Strengthen access and protection. We can help you bring together firewall and VPN management, endpoint detection and response, and Microsoft 365 controls such as multi-factor authentication and conditional access. These add layers of defence and help reduce unnecessary access. Appropriate subscriptions and agreed implementation work may be required. 

• Monitor and escalate. Our monitoring and endpoint security services can help identify faults and suspicious activity and route alerts for investigation. I want customers to be clear about what is monitored, when teams respond and how escalation works. Where contracted, 24/7 security operations centre monitoring can extend security alert coverage, but it does not automatically include all out-of-hours support or recovery work. 

• Keep responsibilities visible. Through service reviews, reporting and supplier coordination, we can help track unresolved risks, changes and follow-up actions. The agreed service scope should make it clear which activities we manage and which sit with your organisation or another supplier. 

Turn security priorities into accountable action 

If you are unsure which services are exposed or who owns the response, I would encourage you to start that conversation. Contact Nviron so we can review your exposure with you, clarify responsibilities and agree remediation priorities. 

• Identify exposure areas – inventory public facing services and SaaS providers 

• Prioritise urgent update cycles – address internet-facing assets first 

• Reduce exposure – restrict management access and apply least privilege access 

• Verify and monitor – test services, retain patch evidence and always investigate suspicious activity 

Conclusion 

My message is straightforward: know which systems and SaaS providers are exposed, make ownership clear, and track risk-prioritised remediation through an agreed change process. I would want evidence that the work is complete, rather than assume a scheduled update has resolved the exposure. 

I would not rely on any single control. Patching, monitoring, restricted management access and least-privilege access need to work together, and we need to check that each is operating as intended. 

At Nviron, we can help bring those priorities together through technical expertise, managed updates, layered protection and monitoring, within the service scope we agree with you. 

For me, the business value is clearer visibility, less pressure on internal teams and greater accountability for remediation and follow-up. 

Where your agreement includes 24/7 SOC monitoring, we can also extend security alert coverage beyond normal business hours. 

That is the approach I want to encourage: moving beyond reactive fixes towards consistent, evidence-led management of cyber risk, with clear responsibilities for customers and suppliers alike.