Dive Brief:

• All nine of the most dangerous enterprise vulnerabilities are more than three years old, according to HP Security Research’s 2015 Cyber Risk Report.

• US-CERT found similar results in its study of the 30 most-targeted network exploits.

• 85% of network attacks are preventable, according to US-CERT estimates.

Dive Insight:

A simple patch, most likely available for years, could have prevented many cyberattacks, studies claim. So why are companies failing to keep up with vendor-issued patches and leaving their systems vulnerable?

Sometimes, the cure appears worse than the disease. Microsoft, Apple and Oracle all released patches in the last year that caused major problems for users. As a result, some CIOs and security leaders have become increasingly cautious about vendor-issued patches.

But manual patching is far too expensive to be considered a viable solution. Instead, vendors must work to help restore customer faith in their automatic updates.

Experts say open communication is key. Vendors need to let their customers know more about patches, what they do, and what implications they have. On the flip side, CIOs must take vendor-issued patches seriously and consider the significant consequences of failing to install them.