Skip to content
Made in the UK

Vulnerability Remediation

Why do software updates alone not close every vulnerability?

By , CEO, CybaVerse. Last reviewed

Software updates alone does not close every vulnerability because many weaknesses are fixed by a configuration change, a registry setting, a script or removing software, not by an update. Unsupported software gets no patches at all, and some patches need extra steps to take effect. A scan after each patch cycle shows what software updates has left open.

This page is part of our vulnerability remediation guide.

Which vulnerabilities do patches not fix?

Patches fix code. Many vulnerabilities live in settings, leftover software or missing protections instead. The Cyber Essentials Plus test specification defines vulnerability fixes as patches, updates, registry fixes, configuration changes, scripts or any other vendor-prescribed mechanism. That list shows how much sits outside routine software updates.

TypeExampleFix
Insecure configurationLegacy protocol left enabledChange the setting
Registry fix requiredVendor fix needs a registry keyApply the key
Unsupported softwareEnd-of-life app or operating systemRemove or replace
Old version left installedPrevious runtime still presentUninstall it
Patch needs extra stepsFix requires a reboot or settingComplete the steps

Why does unsupported software matter so much?

Unsupported software no longer receives security updates, so every new flaw stays open permanently. The Cyber Essentials requirements say in-scope software must be licensed and supported. The CE+ test specification also says traffic-filtering workarounds is not acceptable long term for legacy unsupported operating systems. Removal or replacement is the only lasting fix.

How do you close the gap, step by step?

The steps below help MSPs find and close what software updates leaves behind. They work alongside an existing RMM patch cycle rather than replacing it. Run them after every cycle, so remaining items are dealt with well inside the 14-day window for high and critical fixes.

  1. Step 1: Rescan after software updates

    See which vulnerabilities remain once updates are installed.

  2. Step 2: Group by fix type

    Separate configuration, registry, removal and failed-patch items.

  3. Step 3: Remove unsupported software

    Uninstall or replace anything out of support.

  4. Step 4: Apply configuration and registry fixes

    Follow the vendor's prescribed fix, tested on a small group first.

  5. Step 5: Rescan and record

    Close items only when a scan confirms they have gone.

How should MSPs explain this to clients?

Clients often assume a fully patched estate is a secure one. A short explanation, backed by their own scan results, changes that view quickly. Show them how many findings remained after the last patch cycle and what kind of fix each needs, so the extra work is visible and expected.

  • Show findings remaining after the latest patch cycle
  • Explain which ones need configuration changes or removal
  • Agree who approves changes that might affect users
  • Track the remaining items to closure each month

Where does CybaOps fit?

CybaOps continuous scanning shows what is still open after each patch cycle across every client, and the Remediation Engine can fix security issues automatically, so gaps get closed rather than just reported. Your RMM stays in place for routine updates.

  • CybaVM gives continuous internal and external vulnerability scanning, prioritised in one place in CybaOps.
  • Internal scans run several times a day and external scans run daily.
  • CybaOps ties vulnerabilities to the assets they affect, so teams fix what matters first.
  • The CybaOps Remediation Engine is live today: it can fix security issues automatically, so gaps get closed rather than just reported.

Beyond updates

Why updates alone leaves gaps open

Why updates alone leaves gaps open.

01 Findings from

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Beyond updates

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Remediation in
  • CybaVM
  • CybaRemediate

What else do MSPs ask about security-update gaps?

These are the follow-up questions we hear most from MSPs.

Can our RMM apply configuration fixes?

Often yes, through scripts or policies, but someone has to know which fix each finding needs. A scanner tells you what is still vulnerable; the vendor advisory tells you how to fix it.

Is a fully patched device compliant with Cyber Essentials?

Not necessarily. It also needs secure configuration, supported software, malware protection and proper access control. Security updates cover one of the five controls, and even that needs the vendor's full fix applied.

How do we handle software clients refuse to remove?

Explain the risk, record the decision and check whether it can be taken out of Cyber Essentials scope. Unsupported software in scope fails the assessment, so the client needs to decide before testing.

What should you do next?

See CybaOps vulnerability management and the Remediation Engine on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

Related: patch management vs vulnerability remediation and How do you prove a patch actually fixed the vulnerability?

See what software updates leaves behind on a real estate.

Book a CybaOps demo