Mike Saurbaugh explains that security teams should rank vulnerability fixes by confirmed exploitation and asset exposure rather than relying solely on CVSS scores. He highlights the McKesson incident, where attackers used voice phishing to access Okta SSO and compromise roughly 284 million data records. Saurbaugh also notes the Minnesota water utilities attack, which forced some systems to switch to manual controls. He recommends reducing internet-facing exposure and updating detection playbooks to prepare for zero-day attacks before patches are available.
Read the full story at ians.com.
