hardScenarioSeniorStaffLead
A critical vulnerability is published for software running on a plant segment that will not be patched for nine months. What do you do in the meantime?
5 min readUpdated 2026-08-15
Answer
Short answer
Establish reachability before severity, then remove or narrow the paths that lead to the affected asset rather than trying to fix the asset. Patch the systems around it that can be patched, and record a risk acceptance with an owner and an expiry date instead of a permanent silence.
Was this answer helpful?
Likely follow-ups
- How would you build the asset inventory if active scanning is not permitted?
- The vendor says applying the patch invalidates their support. Does that change your answer?
- What would you monitor to know the mitigation had been bypassed rather than merely assuming it holds?
- The nine-month window slips to eighteen. What is the process consequence?
Related questions
- How would you price a feature that no customer asked for?hardAlso on segmentation6 min
- The business wants to buy and their security team has blocked you over an answer in your questionnaire. How do you get the deal moving again?hardAlso on compensating-controls6 min
- How would you test a model for bias?hardAlso on segmentation6 min
- Two customer segments each bring in the same revenue and you can only focus on one next year. How do you choose?hardAlso on segmentation6 min