Skip to content
Made in the UK

Vulnerability Remediation

How do you remediate configuration and registry vulnerabilities, not just missing patches?

By , CEO, CybaVerse. Last reviewed

Remediate configuration and registry vulnerabilities by reading the vendor's advisory for the exact setting or registry value required, testing the change on a small group of devices, rolling it out in stages through policy or scripts, and rescanning to confirm the finding has gone. Record each change so it can be reviewed and reapplied if settings drift.

This page is part of our vulnerability remediation guide.

What are configuration and registry vulnerabilities?

These are weaknesses caused by how software is set up rather than by flawed code that an update replaces. Examples include legacy protocols left enabled, weak encryption settings, risky default services and vendor fixes that only take effect once a registry value is set. Updates alone often leave them untouched.

The Cyber Essentials Plus test specification counts registry fixes, configuration changes and scripts as vulnerability fixes alongside patches. The Cyber Essentials requirements also include secure configuration as one of the five controls, so these findings matter for certification as well as for security.

Why are these fixes harder than patches?

Configuration fixes are harder because each one changes how a system behaves, and that can break things users rely on. Turning off an old protocol may stop a legacy printer or line-of-business app working. That is why testing and staged rollout matter more here than for most routine updates.

ChallengeWhy it happensHow to handle it
Fix breaks an applicationOld software relies on the weak settingTest first, plan a replacement
Setting revertsGroup policy or a later install overwrites itEnforce through policy, rescan
Unclear fixAdvisory lists several optionsFollow the vendor's preferred fix
Many device typesSettings differ by product and versionGroup devices before changing

How do you remediate them, step by step?

The steps below work for most MSPs. They follow NCSC vulnerability management guidance and the vendor-prescribed fix approach in the Cyber Essentials Plus test specification. Run them for each finding type rather than device by device, so one tested change can be applied consistently across many clients.

  1. Step 1: Group findings by fix

    Collect every device that needs the same setting change.

  2. Step 2: Read the vendor advisory

    Confirm the exact setting or registry value the vendor prescribes.

  3. Step 3: Test on a small group

    Apply the change to a few representative devices and check applications still work.

  4. Step 4: Roll out in stages

    Widen to a pilot group, then to all affected devices.

  5. Step 5: Enforce the setting

    Use policy so the setting does not drift back.

  6. Step 6: Rescan and record

    Confirm the finding has gone and record the change.

How do you stop settings drifting back?

Settings drift when software updates, reinstalls or conflicting policies overwrite them. The fix is to enforce settings centrally and keep scanning, so a reverted setting shows up as a reopened finding rather than staying hidden. We hear from MSPs that drift is most common after major application updates and device rebuilds.

  • Enforce settings through central policy, not one-off changes
  • Rescan after major updates and rebuilds
  • Treat a reopened finding as a policy problem, not a new issue
  • Document every setting change with the vendor reference

Where does CybaOps fit?

CybaVM gives continuous internal and external vulnerability scanning, so a finding that comes back shows up again in the next scan. The CybaOps Remediation Engine is live today: it can fix security issues automatically, so gaps get closed rather than just reported. Keep your own change control for every change window.

  • CybaVM gives continuous internal and external vulnerability scanning, prioritised in one place in CybaOps.
  • Vulnerability scanning in CybaOps is powered by Qualys.
  • Internal scans run several times a day and external scans run daily.
  • CybaOps ties vulnerabilities to the assets they affect, so teams fix what matters first.

Config and registry fixes

How to remediate config and registry findings

Remediate configuration and registry vulnerabilities by reading the vendor's advisory for the exact setting or registry value required, testing the change on a small group of devices, rolling it out in stages through policy or scripts, and rescanning to confirm the finding has gone.

01 Findings from

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Config and registry fixes

02 The 6-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Remediation in
  • CybaVM
  • CybaRemediate

What else do MSPs ask about configuration fixes?

These are the follow-up questions MSP engineers ask most about non-patch remediation.

Can an RMM apply registry fixes?

Usually yes, through scripts or policies. The harder part is knowing which value each finding needs and testing it safely. Use the vendor's advisory as the source of the fix, not a forum post.

What if the fix breaks a business application?

Pause the rollout, restore the previous setting on affected devices and talk to the client. Record the risk, agree a short deadline and plan to update or replace the application that depends on the weak setting.

Do configuration findings count for Cyber Essentials Plus?

Yes. The test specification treats configuration changes and registry fixes as vulnerability fixes, so an unfixed high or critical configuration finding on a sampled device can fail the assessment just like a missing patch.

What should you do next?

See CybaOps vulnerability management and the Remediation Engine on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

Related: Why do software updates alone not close every vulnerability? and patch management vs vulnerability remediation

See the Remediation Engine fix security issues in a demo.

Book a CybaOps demo