Vulnerability Management & Patch Compliance Posture

Orbis Healthcare Systems · 6,800 Managed Assets · Last Updated: 2024-01-15 08:30 UTC

16-Week Reporting Period 4 Hospitals + 12 Clinics MEW Goal: <7 days on Tier-1 assets
MEAN EXPLOIT WINDOW
11.4d
-37% vs Week 1
EPSS EXPOSURE SCORE
682
-18% vs Week 1
CRITICAL PATCH SLA
73%
+19pp
Target: 90%
CVE DISCOVERY RATE
18/wk
+12% vs Avg
Critical + High
SCAN COVERAGE
94%
+7pp
Last 7 days auth
EXCEPTION RATE
8.2%
+1.3pp
91% w/ controls

Mean Exploit Window Trend with KEV Weaponization Events

16-week trend · Red markers indicate CISA KEV surge events

BU Risk Score Leaderboard

Business Unit Risk Score Open CVEs
Epic EHR Production1,847124
Azure Cloud Workloads1,60298
Patient Portal & Web1,31967
Medical Imaging (PACS)1,09182
Finance & Billing87641
HR & Payroll64329
General IT Infrastructure51238

Patch SLA Compliance by Severity

CVE Discovery vs. Remediation Rate

Repeat Vulnerability Rate by BU

Third-Party Software Vulnerability Concentration

Open CVEs by vendor · Size represents total CVE count

Microsoft
127
23 Critical
Apache
84
11 Critical
Oracle
62
8 Critical
VMware
47
6 Critical
Cisco
39
4 Critical
Adobe
31
3 Critical
Red Hat
28
2 Critical
Other
71
5 Critical

Scanning Coverage Trend

Compensating Control Coverage

Exception Approval Rate

Open Critical Vulnerabilities Detail

CVE ID Severity EPSS Affected Assets Business Unit Days Open KEV
CVE-2023-23397Critical0.94127Epic EHR Production23Yes
CVE-2023-36884Critical0.89103Azure Cloud Workloads19Yes
CVE-2023-4966Critical0.8789Patient Portal & Web31Yes
CVE-2023-38831Critical0.8267Finance & Billing14No
CVE-2023-3519Critical0.7854Epic EHR Production27Yes
CVE-2023-29357High0.7141Medical Imaging11No
CVE-2023-20198Critical0.6938General IT18Yes
CVE-2023-35078Critical0.6629HR & Payroll8No

Remediation Velocity

76%
of target velocity
23.4 CVEs/week closed

Asset Criticality Distribution

Time-to-Remediate by Severity

Critical8.2 days
High14.7 days
Medium31.2 days