By Kesavardhanan Jayaraman, Founder and CEO, K7 CyberSecurity
Britain’s National Health Service (NHS) is one of the world’s largest publicly funded universal healthcare systems, serving an average of 1 million patients every 36 hours, with an annual budget of more than $200 billion. On May 12, 2017, computers across the UK’s NHS began freezing as the WannaCry ransomware attack rapidly spread, infecting more than 200,000 machines across over 150 countries within hours. At least 19,000 NHS appointments and procedures were cancelled; emergency departments turned patients away, and ambulances were diverted to other hospitals. But the most uncomfortable detail emerged later, after the investigation. Just 59 days before the outbreak, Microsoft had released a fix in its security bulletin MS17-010, but none of the 80 NHS organisations affected had applied it.
Almost a decade later, the lesson has not been learned. The same exploit families, MS17-010 and EternalBlue, are still behind almost 40% of global intrusion attempts. Vulnerability exploitation was the initial access route in almost 20% of breaches, up 34% on the year before. According to Verizon’s 2025 Data Breach Investigations Report, enterprises are still exposed to one of the oldest threats despite the solution being widely available.
The industry’s attention is not where it should be. Conference agendas and security budgets are dominated by AI-driven attacks, zero-days and nation-state tradecraft. And while these threats are real, attackers are pragmatic. They use what works. A known gap in the enterprise’s defences, such as an unpatched system, is practically an invitation for hackers. Particularly if it can be found by automated scanning and spread across a network without human intervention. A rupee spent on the newest detection tool often buys less safety than the same rupee spent closing gaps that have been public for years.
Why do capable enterprises fail at something so basic? Equifax offers a parallel from the same year. Apache announced a critical flaw on March 6, 2017. Equifax went five months without applying the fix. This led to around 148 million records of people getting stolen. The causes were structural. Extremely large enterprises that nobody had fully inventoried, legacy systems that cannot easily be patched, and teams that fear downtime more than exposure. Patching is rarely a technology problem. It is an operational and accountability problem, and it has to be treated as one. It is for this reason that enterprises should act on five fronts.
First, make patch latency a board-level metric. The mean time to patch critical vulnerabilities deserves the same scrutiny as any financial indicator because the exposure it measures can be just as costly, and in some cases, it can cause much more damage.
Second, start with visibility. A complete, current asset inventory comes before everything else. An organisation cannot patch what it does not know it has. Forgotten servers and shadow IT are exactly where old points of exploitation survive.
Third, prioritise by active exploitation, not just severity scores. Live threat telemetry shows which flaws attackers are using right now. The 39% figure is a reminder of how much that matters. A vulnerability being exploited at scale this month should jump the queue ahead of one that merely scores high on paper.
Fourth, contain what cannot be patched. Some systems, particularly in healthcare, manufacturing, and utilities, cannot be updated easily or at all. Segment them from the rest of the network and retire from obsolete protocols such as SMBv1 wherever possible.
Fifth, close the loop in the security operations centre. Vulnerability data should flow directly into detection and response so that an unpatched system under active attack is flagged as an urgent priority rather than buried in a backlog. Where those functions sit in separate tools that do not talk to each other, that is where gaps persist.
None of this is glamorous, which is precisely why it keeps being deferred. Boards rarely celebrate a quarter in which nothing happened. But the most valuable upgrade most enterprises can make this year is not a new tool. It is the discipline to finish the old work.
The NHS did not fall to a sophisticated adversary in May 2017. It fell to a fix that had been sitting on the shelf for 59 days. Nearly a decade later, the question for every CISO and board is whether their own shelf is any emptier.