Vulnerability management and patchingInternal research

Fix what attackers can actually reach.

Patching applications and operating systems are two of the Essential Eight. We match you to tools that close what's exploitable in your environment first, and prove it's gone.

Prioritise your patchingSee the research

Free. No fit, no obligation.

Architecture

Four problems, not one product.

Every vulnerability program wrestles with the same four. Name yours before you shop for a tool.

  1. 01

    Seeing what you have

    A static scanner takes a snapshot every few hours. Between scans, and across every device you didn’t know was there, you’re blind.

  2. 02

    Knowing what matters

    A scan returns thousands of findings. Working out which handful can actually hurt you is the labour that eats the week.

  3. 03

    Too many tools for one job

    A scanner here, a patching tool there, a separate operating-system patcher. Three consoles to do what should be one job.

  4. 04

    The gap with no patch

    Sometimes a known vulnerability has no fix yet, and it still has to be dealt with before one arrives.

The problem

Finding gaps is easy. Closing them is the work.

Finding vulnerabilities is commoditised. Every scanner on the market returns a long list, and your risk is in a few lines of it. The value sits in closing the gaps that matter and proving them gone, which is the part most tools leave to you.

Your environment decides which gaps matter. A critical rating might be a five in your network, and a low one might escalate because it's internet-facing and already exploited. Good prioritisation re-rates every finding against the 20 to 30 things true only of your environment.

Two of eightPatching applications and patching operating systems are both Essential Eight strategies.

What you get

What good vulnerability management gives you.

What closing gaps looks like, past the length of a report.

Effort spent where the risk is

Prioritisation by what’s exploitable in your environment, so your team fixes the few findings that can actually be used against you.

What to look for

What can the top platforms do?

Scanning, a CVE feed and a patch button come with everything now. The list below is what separates a program that closes gaps from one that only counts them.

  • Risk-based prioritisation

    The published score plus the data points unique to your environment, re-rating each finding up or down so the queue reflects real exposure.

  • Real remediation, not just scanning

    Patching and deployment built in, so finding a gap and closing it happen in one console.

  • Third-party and operating-system patching together

    The applications attackers actually target, alongside the operating system your existing tooling already covers.

  • Patchless protection for the un-patchable

    In-memory shielding for the vulnerability with no fix available. It reduces the risk until the patch arrives.

  • Remediation validation

    A re-test that proves each gap is closed, which is the evidence an auditor asks for.

  • Ring and phased deployment

    Patches rolled out in controlled waves with exclusion windows, so a fix never takes down the business it was meant to protect.

Maturity

The backlog is usually bigger than the team.

Vulnerability management maturity, tier by tier.

  1. Focused

    A scanner run periodically, findings triaged by hand, patching left to the RMM or to whoever has time. The list grows faster than the team can work it. Many mid-market teams sit here.

    Typical features

    • A scanner run now and then
    • Findings triaged by hand
    • Patching left to the RMM
    • A list that grows faster than it shrinks

  2. Broad

    Risk-based prioritisation, remediation and third-party patching working as one program, with the Essential Eight patch controls met as a matter of routine.

    Typical features

    • Risk-based prioritisation
    • Third-party application patching
    • Remediation tracked to closure
    • Essential Eight patch windows met routinely
    • One program, not separate tools

  3. Best fit if you’re being targeted

    Comprehensive

    Everything Broad does, plus prioritisation tuned to your environment, shielding for the un-patchable, and remediation validated and evidenced. The most room to adapt as new exploits land. It’s where we’d begin if you run internet-facing systems you can’t patch inside the Essential Eight windows.

    Everything in Broad, plus

    • Prioritisation tuned to your environment
    • Shielding for what cannot be patched
    • Fixes validated and evidenced
    • Patching automated as far as is safe
    • Proof ready for auditors and insurers

Vulnerability management and patching

Hygiene is one layer of three.

Prevention, detection and response, and hygiene share the same endpoint. Each makes the others' job smaller.

  1. 01

    Prevention

    Prevention decides what is allowed to run at all. Controlling execution shrinks what could ever exploit a gap.

    Explore application control
  2. 02

    Detection and response

    Catching and containing what operates inside what you have allowed, when something gets through.

    Explore detection and response
  3. 03

    Hygiene

    Closing the doors before anyone tries them. Patching and remediation shrink the surface the other two layers watch. This is the layer you’re on now.

Tekspace Research

We research the vulnerability management and patching field.

Internal research

Vulnerability and Exposure Management

How fast do you fix what attackers can actually reach?

Closes the gap between finding vulnerabilities and fixing them, worst first.

What we found

Attackers use a disclosed flaw within hours, while most organisations fix it in months. Where a fix won’t land in time, a compensating control is the defensible answer.

Vendors assessed

  • Action1
  • Automox
  • HCL BigFix
  • Ivanti Neurons
  • ManageEngine
  • NinjaOne
  • PDQ Connect
  • Qualys VMDR
  • SecOps Solution
  • Tanium
  • Tenable One
  • Vicarius vRx

What we test

  • Ranked by exploitability, not raw CVSS
  • OS and third-party patching automated
  • Essential Eight remediation tracked

Same tests on every product. The scores publish with the benchmark.

The Tekspace Fit Method

How we’d help you choose.

Five steps from the problem you have to the product that fits, each leaving you with something you keep.

  1. 01

    Understand

    For vulnerability management and patching

    Agree what exploitable means for you, and the Essential Eight patch windows you have to meet.

    What you get

    Problem brief. The agreed problem and what success looks like.

  2. 02

    Map

    For vulnerability management and patching

    Your assets, scanners, patch tooling, internet-facing systems, and who fixes what.

    What you get

    Environment map. Your tools, identity, users and constraints.

  3. 03

    Narrow

    For vulnerability management and patching

    The platforms that prioritise, remediate and patch in one place, matched to how your team already works.

    What you get

    Shortlist with reasons. Why each option made it, and why the rest did not.

  4. 04

    Prove

    For vulnerability management and patching

    Prioritisation run on your own findings shows which few actually matter.

    What you get

    Proof-of-value results. How each option did against your problem.

  5. 05

    Enable

    For vulnerability management and patching

    Connect remediation to patching, set the windows, and evidence each closure for the auditor.

    What you get

    Handover plan. Deployment, training and who owns what.

See our methodology

Questions we hear most.

Even where we have a product we like, we’ll recommend something else if your context calls for it.

  • No consulting fee
  • If nothing fits, we say so
  • Vendor-independent
  • Operating since 2006