Skip to content
Made in the UK

How do MSPs remediate vulnerabilities across clients?

By , CEO, CybaVerse. Last reviewed

MSPs remediate vulnerabilities across clients by running one risk-based process for every tenant: find missing fixes, prioritise critical and high-risk ones, deploy within 14 days, fix configuration weaknesses that updates do not cover, then rescan to prove each fix worked. Failed or partial fixes go straight back into the queue with an owner.

This guide is part of the CybaVerse Knowledge Hub.

Why is patching across many clients so hard?

Every client has a different mix of devices, applications, change windows and appetite for reboots. An MSP has to apply one standard across all of them, often with RMM tools that cover the operating system well but miss third-party applications, configuration fixes and devices that are offline when the patch window runs.

The Cyber Essentials requirements make the bar explicit. Updates that fix critical or high-risk vulnerabilities, or those with a CVSS v3 base score of 7 or above, must be applied within 14 days of release. From April 2026, IASME treats missing that window as an automatic fail on the self-assessment questions about updates.

What is the difference between patching and remediation?

Patching installs vendor updates. Remediation is the wider job of removing a vulnerability by whatever means the vendor prescribes, including configuration changes, registry fixes, scripts or removing unsupported software. The Cyber Essentials Plus test specification counts all of these as vulnerability fixes, so a patch-only process leaves gaps.

TaskPatchingRemediation
Install vendor updatesYesYes
Change insecure configurationNoYes
Apply registry or script fixesNoYes
Remove unsupported softwareNoYes
Verify the vulnerability is goneOften notYes

How should an MSP run vulnerability remediation?

Run patching and wider remediation as one loop rather than separate jobs. The steps below work for most MSPs and match the NIST guidance on enterprise patch management. They keep every client on the same standard while respecting each client's change windows, critical systems and approval rules.

  1. Step 1: Know every asset

    Build one inventory per client, including devices that rarely connect.

  2. Step 2: Scan continuously

    Find missing updates and insecure settings on every device, not just a sample.

  3. Step 3: Prioritise by risk

    Start with critical and high-risk fixes, known exploited vulnerabilities and issues on many devices.

  4. Step 4: Deploy within the window

    Patch inside 14 days for qualifying fixes, with approval for sensitive systems.

  5. Step 5: Fix what patching misses

    Apply configuration, registry and policy fixes, and remove unsupported software.

  6. Step 6: Rescan and close

    Close an item only when a rescan confirms it has gone from every device.

Which questions does this cluster answer?

The pages below cover the remediation questions MSPs ask most, from failed patches to proving a fix worked. Each one starts with a direct answer and practical steps. Use the links to go straight to the question you need.

  • How do MSPs meet the 14-day patching rule across every client?
  • What is the difference between patch management and vulnerability remediation?
  • How do MSPs track and fix failed patches?
  • How do you prove a patch actually fixed the vulnerability?
  • Why does patching alone not close every vulnerability?
  • How do MSPs remediate a compromised Microsoft 365 account?
  • How do you remediate configuration and registry vulnerabilities, not just missing patches?

How does the CybaOps Remediation Engine help?

The Remediation Engine is the part of CybaOps that helps MSPs move from finding vulnerabilities to fixing them. It is live today and can fix security issues automatically, so gaps get closed rather than just reported. It sits alongside an MSP's existing RMM, which stays in place for deploying updates.

  • CybaVerse focuses on closing the route an attacker used, then checking the rest of the estate for the same weakness.
  • CybaRemediate is our remediation product line, built on the Remediation Engine.
  • Keep your own change control and backout plan for every patch window.

Remediation across clients

How MSPs remediate across every client

MSPs remediate vulnerabilities across clients by running one risk-based process for every tenant: find missing fixes, prioritise critical and high-risk ones, deploy within 14 days, fix configuration weaknesses that updates do not cover, then rescan to prove each fix worked.

01 Findings from

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Remediation across clients

02 The 6-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Remediation in
  • CybaVM
  • CybaRemediate

What else do MSPs ask about vulnerability remediation?

These are the follow-up questions we hear most from MSP engineers and service managers.

Does the Remediation Engine replace our RMM?

No. Keep your RMM for deploying updates. CybaOps adds vulnerability scanning and prioritisation. The Remediation Engine can fix security issues automatically, so gaps get closed rather than just reported.

When does the 14-day clock start?

The Cyber Essentials requirements measure 14 days from the vendor's release of the update. It does not start when your scanner detects the missing update or when a ticket is raised, so detection speed matters.

Is virtual patching acceptable for Cyber Essentials?

Not for legacy unsupported operating systems in the long term. The Cyber Essentials Plus test specification says virtual patching will not be recognised as a way to comply in that case. Remove or replace unsupported software instead.

What should you do next?

See how the pieces fit together on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

See the Remediation Engine fix a security issue in a live demo.

Book a CybaOps demo