How Qualys Supports the National Cyber Security Centre (NCSC)’s Vulnerability Management Guidance | Qualys
Summary: The UK's National Cyber Security Centre published vulnerability management guidance with five principles and remediation timelines of 5 days for internet-facing services, 7 days for operating systems and applications, and 14 days for internal or air-gapped systems. Qualys reports that, based on its anonymized data, UK organisations average 17 days to remediate external-facing vulnerabilities and 15 days for non-external-facing ones, and that many customers have more than 30% of Microsoft-related vulnerabilities still open 30 days after release.
Key Takeaway: The gap between the NCSC's 5-day target for internet-facing software and the observed 17-day average is the exposure window an attacker gets on the systems most reachable from outside, and Qualys' data puts more than 30% of Microsoft-related vulnerabilities still open at 30 days.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026