IT Horror Stories: How Unpatched Software Hurts Businesses

Within every IT infrastructure, threat actors leverage numerous entryways  to steal data and harm businesses. One popular entryway is unpatched software. Almost every IT team out there dreads patching software, and it’s easy to see why.

Patching is tedious and time-consuming work, and sometimes it disrupts systems so much that it does more harm than good. However, despite how frustrating it can be to patch endpoints, it’s critical for IT security

Read on, and we reveal just how dangerous the consequences of unpatched software can be for IT teams.

What is unpatched software?

Unpatched software refers to applications or systems that contain known security vulnerabilities that have not yet been addressed through updates or patches. If exploited, these vulnerabilities can potentially compromise the affected system’s security.

As soon as software vendors discover and acknowledge these vulnerabilities, patches are developed to mitigate the identified risks. It is crucial to keep systems updated and patched using a clear patch management process. Failure to do so can expose systems to potential exploits, as threat actors are often aware of the vulnerabilities before patches are released.

Consequences of unpatched software in 2024

Leaving software unpatched and vulnerable creates some serious security weaknesses. Just take a look at a few of the data breaches that have occurred in 2024 within some of the largest and most well-known companies.

Data breaches of 2024

Change Healthcare

Last February, United Health-owned prescription processor Change Healthcare was the victim of a massive cyberattack that cost the company nearly $2.9 billion. Given the unprecedented magnitude of this data breach (of which the private data of 500 individuals were exposed), the Office for Civil Rights (OCR) opened investigations into Change Healthcare for possible violations of HIPAA rules.

Ivanti VPN

Ivanti Connect Secure and Policy Secure products came under mass exploitation last January. Threat actors exploited two high-severity zero-day vulnerabilities in the systems, impacting thousands of Ivanti VPN devices, including the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

AT&T breach

In March, AT&T announced that it was investigating a data breach involving the personal information of 70 million customers (both current and former) leaked on the dark web.

Ascension

A cyberattack disrupted operations at Ascension, a health system that includes 140 hospitals and 40 senior living facilities across 19 states, last May. According to the nonprofit, they detected “unusual activity” on some of its network systems and immediately started investigating.

Check out this general list of consequences that unpatched software can have on your organization.

• Security vulnerabilities: One of the most significant consequences of unpatched software is an increased risk of security vulnerabilities. When software is not up to date with the latest patches, it may contain known security vulnerabilities that can be exploited by hackers or other malicious actors.
• Compliance issues: Many organizations are subject to regulations that require them to maintain secure systems and software. If your software is not current with the latest patches, you may violate of these regulations, resulting in fines, penalties, and other sanctions.
• Loss of data: Unpatched software can also result in the loss of sensitive data. If a security vulnerability is exploited, hackers may access and steal confidential information, such as personally identifiable information, customer data, or financial records.
• Damage to reputation: In today’s digital age, data breaches and other security incidents can have a major impact on an organization’s reputation. If your organization is affected by a security incident due to unpatched software, it could damage your reputation and make it difficult to regain customers’ trust.
• Lost productivity: Besides the potential financial and reputational costs, unpatched software can also lead to lost productivity. If a security vulnerability is exploited and your systems are compromised, it can disrupt your operations and prevent your employees from working effectively.

Overall, the consequences of unpatched software can be severe and far-reaching. Implementing patch management ensures that your systems and software are always up-to-date and secure.

Cybersecurity & vulnerability statistics

The statistics listed below are only the most colorful recent examples of negligent patching practices, but many executives have their heads in the sand about the severity of the problem. “Small business owners tend not to focus on security because they see it as a liability and a cost center,” says AJ Singh, vice-president of product at NinjaOne.  “They don’t consider the losses from outages.”

Let’s take a look at some of the top cybersecurity statistics of 2024 to see just how important patching is for every IT team and business:

Malware and ransomware statistics

• The State of Ransomware 2024 report states that ransomware attacks remain the top cybersecurity threat this year.
• There were more than 2,500 ransomware attacks in the first half of 2024; that’s more than 14 publically claimed attacks daily, according to Rapid7.
• 32% of cyberattacks start with an unpatched vulnerability, based on the State of Ransomware 2024 report by Sophos.

Endpoint management and patching cybersecurity statistics

NinjaOne’s cybersecurity statistics report emphasizes that:

• 45% of businesses do not have any cyber insurance cover whatsoever
• Of those that do have coverage, 37% aren’t covered for ransomware payments
• About 1 in 5 consumers fall victim to scams, particularly phishing links.

Unpatched vulnerabilities statistics

Automox’s 2022 unpatched vulnerability report shows these results:

• Unpatched vulnerabilities are directly responsible for 60% of all data breaches.
• Despite this statistic and the risks that unpatched software creates, this research shows that “A staggering majority of CIOs and CISOs even say that they delay putting security patches through to avoid interrupting business growth – and 25 percent say that they are certain their organization is not compliant with data security legislation.”

Post-pandemic cyber attack statistics

Qualys 2024 midyear threat review found:

• From January to mid-July 2023-2024, patch common vulnerabilities and exposures (CVEs) rose by 30%.
• 0.9% of vulnerabilities detected this year have been weaponized.
• However, there was a 10% increase in the weaponization of old CVEs in 2024.

High-Risk Behavior: Notable examples of unpatched software

2024 may be ending, but who knows how many more cyberattacks will occur before the end of the year?. Let’s look at some of the more notable examples—or, more appropriately, IT horror stories—that you should be aware of.

Unpatched software horror story	# of records exposed	Terrifying plot twist
AT&T confirmed not one but two separate data breaches that compromised “nearly all” of its customers.	Around 110 million	Supposedly, AT&T paid a hacker $37,000 to delete the stolen data; however, according to TechCrunch, the “metadata” still reveals who called who and when, which hackers can use to infer approximate locations.
Change Healthcare, one of the largest healthcare technology companies in the United States, was hacked by a ransomware group.	6 TB of data	The lengthy downtime caused by the cyberattack lasted for weeks, causing widespread outages in hospitals and other medical facilities nationwide.
Ticketmaster confirmed in a federal filing last May that it was investigating a data breach that stole the information of millions of customers.	560 million	Hackers reportedly put 1.3 TB of user data up for sale on the dark web. It is still unclear how hackers were able to access the data.
A massive data breach affected 27 pharmaceutical and biotechnology companies.	Extent is unknown but estimated at millions	Three HIPAA breach reports have already been filed, with several more cases being investigated.

How automated patching reduces security risks

Though reputable vendors typically offer free, automated patching for outdated software, the process can sometimes break down or cause software to malfunction. “Patching is an uphill battle,” Singh says. “There are new threats out every day.” Our internal research at NinjaOne shows that 25-30% of Windows 10 patches fail, which is why we custom-built a utility to successfully execute the process and remediate threats.

Benefits of automated patching for IT teams

Automated patching is an indispensable tool for contemporary IT teams, offering a host of benefits that streamline and fortify operations.

• Reduces your workload: Automated patching significantly reduces the manual workload, ensuring that software updates and vulnerability patches are consistently applied without the need for continuous oversight. This efficiency minimizes human error and frees IT professionals to focus on more strategic tasks and projects.
• Ensures systems are properly updated: With cyber threats becoming increasingly sophisticated, automated patching ensures that systems are promptly updated, thereby reducing potential security breaches and safeguarding critical data.
• Ensures uniformity in updates: Automated patching’s “set it and forget it” nature ensures that all devices in a network are synchronized and compatible, reducing potential system conflicts or incompatibilities. This level of consistency also enhances system performance and reduces downtime, leading to increased productivity.
• Allows flexibility in IT teams: The capability to tailor patching at a granular level gives IT teams the flexibility to adapt to specific organizational needs, allowing for custom patch schedules or selective patch deployments. In essence, automated patching provides IT teams with a combination of efficiency, security, and flexibility, making it a cornerstone of effective IT management.

Discover how GSDSolutions was able to save time through automation.

“From a functionality perspective, patch management is really easy to setup and automate – and it really just works. Ninja’s integrations are fast and reliable. ”

Mark Andres, Director of IT Services at GSDSolutions

How to implement patch management

Before implementing patch management, ensure you have undergone these initial steps in your organization.

• Assessing needs: Before implementing patch management, it’s important to evaluate your organization’s needs. This helps you to determine the systems and software that need to be patched, as well as the frequency and scope of the patching process.
• Choosing a solution: There are many top patch management solutions available, including both commercial and open-source options. When selecting a solution, consider factors such as ease of use, compatibility with your existing systems, and the level of support provided.
• Getting the right people involved: Patch management is not a one-person job. It’s essential to involve the right people in the process, including IT staff, system administrators, and other relevant stakeholders. Training may also be necessary to ensure everyone knows how to use and implement the patch management solution correctly.
• Creating a policy: Patch management should be a long-term process, not just a one-time event. To ensure that patches are implemented consistently and effectively, it’s crucial to create a patch management policy that outlines the processes, procedures, and responsibilities involved. This policy should be reviewed and updated regularly to reflect your organization’s systems and software changes.

To implement patch management, follow these steps:

1. Identify the systems and software that need to be patched. This can include operating systems, applications, and other types of software.
2. Create a patch management schedule. Decide how often you will check for new patches and how you will implement them. For example, you can check for new patches once a week and implement them every month.
3. Set up a patch management process. Determine who will be responsible for implementing patches and how they will be implemented. For example, you may decide to use a patch management tool to automate the process.
4. Monitor the patch management process. Check regularly to ensure that patches are being implemented correctly and on schedule.
5. Test patches before implementing them. Testing patches in a non-production environment is vital to ensure they don’t cause any issues before implementing them in your live systems.
6. Keep track of all implemented patches. This will help you determine which systems and software are up to date and which may need to be patched in the future.

By following these steps, you can ensure that your systems and software are always up-to-date and secure. However, some additional aspects to consider when implementing patch management in your organization are as follows:

Eliminate security threats with NinjaOne patching

Ultimately, patching is both too important and too tedious for non-professionals to manage. That’s why NinjaOne offers patch management software that takes the pain out of this essential process. See why G2 ranked NinjaOne the #1 Patch Management Software in their latest report.

NinjaOne’s IT management software has no forced commitments and no hidden fees. If you’re ready, request a free quote, sign up for a 14-day free trial, or watch a demo.