Our recent LinkedIn poll asked the question: ‘What is the most common way cyber criminals initially gain access to a business’ and the results were surprising, with only 21% answering correctly; software vulnerabilities.
When we think about cyberattacks, phishing emails, stolen passwords and suspicious links usually come to mind. But the risk that organisations cannot afford to overlook is the weaknesses in the software they use every day.
From business applications and cloud platforms to operating systems and network security tools, software keeps organisations running. However, when it contains security flaws, it can give cybercriminals a direct route into systems, potentially exposing sensitive information or disrupting operations.
This Cybersecurity Awareness Month, it’s time to look beyond user behaviour and ask a bigger question: are the systems your organisation relies on secure enough to keep attackers out?
The software flaws that open the door
Imagine your organisation uses a business application with a known security flaw. The provider releases an update, but installing it gets delayed. Meanwhile, an attacker discovers the vulnerable application and exploits the weakness to gain access.
There’s no phishing email, no stolen password and no employee clicking the wrong link. The attacker simply takes advantage of a weakness that was already there.
That’s what makes software vulnerabilities such a serious concern: attackers don’t always need to trick their way in when a technical flaw can let them in directly.
What Verizon’s 2026 report tells us
The latest findings from Verizon’s 2026 Data Breach Investigations Report (DBIR) highlight just how important this issue has become.
According to the report, exploitation of software vulnerabilities accounted for 31% of breaches as an initial access method, making it the leading entry point for attackers for the first time in the report’s 19-year history. Credential abuse accounted for 13%.
The report also highlights challenges in fixing known weaknesses. Only 26% of critical vulnerabilities listed in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalogue were fully remediated in 2025, down from 38% in the previous reporting period. Meanwhile, the median time to fully resolve a critical vulnerability increased from 32 to 43 days.
These figures reveal a worrying gap between identifying vulnerabilities and fixing them.
Employee awareness training remains essential, but it won’t fix an unpatched server or an exposed network device. Organisations need to protect both their people and the technology they depend on.
Source: Verizon, 2026 Data Breach Investigations Report. The report analyses incidents from 1 November 2024 to 31 October 2025.
Why attackers target known vulnerabilities
Cybercriminals often look for opportunities that offer the greatest reward for the least effort. Exploiting a known software weakness can provide exactly that.
Once a vulnerability becomes public, software providers may release a patch and security researchers may publish technical details. While this information helps organisations protect themselves, attackers can also use it to identify systems that haven’t been updated.
The time between a vulnerability becoming known and an organisation fixing it can therefore be critical.
Internet-facing systems are particularly attractive targets. These include virtual private network (VPN) appliances, firewalls, remote access tools and web applications.
If attackers exploit one of these systems, they may gain an initial foothold and attempt to access sensitive data, move between systems or deploy ransomware.
The risk also extends to third-party software. Applications, plugins and software libraries can introduce vulnerabilities even when an organisation’s own systems are well maintained.
Patching is essential, but it’s not enough
Installing security updates is one of the most effective ways to address known vulnerabilities. However, patching can be complicated, particularly in large organisations where updates require testing and downtime must be carefully managed.
The solution is a structured vulnerability management process that identifies weaknesses, assesses their severity and ensures the most urgent issues are addressed first.
Organisations should prioritise vulnerabilities that are actively being exploited, affect internet-facing systems or could expose critical business information. Maintaining an accurate inventory of software, devices and cloud assets is equally important.
Where immediate patching isn’t possible, temporary safeguards can help. These might include restricting network access, disabling affected services or applying vendor-recommended mitigations.
Patching should also sit alongside regular security testing, strong access controls, secure configurations, network segmentation and reliable backups. No single measure can eliminate every risk, but together they can make attacks harder to carry out and limit their impact.
Cybersecurity is everyone’s responsibility
Although software vulnerabilities are technical issues, managing them isn’t solely the responsibility of IT teams.
Senior leaders need to provide the resources required to maintain secure systems. Procurement teams should assess suppliers’ security practices, while developers need to build security into applications from the beginning.
Employees also have a role to play. Avoiding unauthorised software, following approved processes, reporting unusual activity and understanding why updates matter can all strengthen an organisation’s security.
Cybersecurity awareness should go beyond telling people what not to click. It should help everyone understand how everyday decisions, from installing an application to approving a supplier, can affect the organisation’s overall risk.
Five practical steps to reduce software vulnerability risk
This Cybersecurity Awareness Month, organisations can take five practical steps:
- Keep software up to date. Apply security patches promptly, particularly for vulnerabilities known to be actively exploited.
- Know what you have. Maintain an accurate inventory of applications, devices, cloud services and third-party components.
- Prioritise by risk. Address weaknesses that are actively exploited, exposed to the internet or capable of causing significant harm first.
- Test and monitor systems. Use vulnerability scanning, penetration testing and security monitoring to identify weaknesses and suspicious activity.
- Make security part of everyday decisions. Combine technical safeguards with employee education, supplier oversight and clear accountability.
These steps can help organisations move from reacting to security incidents towards preventing attacks before they happen.
Closing the door before attackers arrive
Verizon’s 2026 DBIR sends an important message: software vulnerabilities are no longer a risk organisations can afford to treat as an afterthought.
With vulnerability exploitation accounting for 31% of breaches as an initial access method, identifying and fixing weaknesses quickly needs to be a priority. Delayed updates and overlooked systems can create opportunities that attackers are ready to exploit.
Effective cybersecurity isn’t about choosing between people and technology. It’s about bringing both together with clear processes and consistent action.
This Cybersecurity Awareness Month, don’t just ask whether your employees can spot a suspicious email. Ask whether your software is giving attackers an opportunity to get in, and what you’re doing to close that door. If you would like to take advantage of Minerva’s current offer of some free cyber consultancy, please get in touch with us here