IT & Cyber Audit
Patch & Vulnerability Status
Most successful breaches exploit known vulnerabilities for which a patch already existed, making patch latency a measurable, manageable risk.
Why Patch Status Matters
Unpatched systems are the path of least resistance for attackers, and POPIA's requirement to maintain appropriate security safeguards effectively obliges entities to manage vulnerabilities diligently. The AGSA and ISSAI 5300 treat patch and vulnerability management as a core IT operations control, because an open critical vulnerability is a control failure waiting to be exploited. AuditPro Core tracks outstanding patches and open vulnerabilities by severity across the estate so remediation is prioritised by risk rather than convenience.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Open vulnerabilities
1,284
Critical open
63
past SLA
Patch compliance
82%
▲ 4 pts
Mean age (days)
27
Open vulnerabilities by severity
Critical exposures past SLA
| Asset group | Open | Avg age (d) | SLA met % |
|---|---|---|---|
| Internet-facing | 21 | 34 | 61 |
| Internal servers | 18 | 29 | 74 |
| Workstations | 14 | 22 | 81 |
| Network devices | 6 | 41 | 58 |
| Databases | 4 | 38 | 66 |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Severity-based prioritisation
Not every vulnerability is equal; a critical remote-exploit flaw demands action in days, while a low-severity issue can wait. Prioritising by severity ensures scarce remediation effort goes where the risk is greatest.
Patch latency
The time between a patch being available and it being applied is the window of exposure. Measuring latency by severity turns a vague concern into a concrete service-level commitment.
Estate coverage
A vulnerability is only closed when every affected asset is remediated, so coverage across the full estate matters. Forgotten servers and legacy systems are where unpatched flaws persist.
How AuditPro Core Bridges the Gap
- Severity ranking: open vulnerabilities and outstanding patches are ranked by severity to drive risk-based remediation.
- Latency tracking: time-to-patch is measured against severity-based targets.
- Continuous monitoring: new vulnerabilities and overdue patches surface as the estate changes.
- Audit-ready export: the vulnerability register exports as evidence for the IT operations and security-safeguards assessment.
Key Takeaways
- Known, unpatched vulnerabilities are the leading breach vector — and the most preventable.
- Prioritise by severity so critical flaws are closed in days, not months.
- Measure patch latency against targets to make exposure a managed metric.
- Closure requires full estate coverage; legacy assets are the usual blind spot.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.