The changed threat model
For years, vulnerability management ran on an assumption: find the flaws, patch them in priority order, and you stay ahead. It was always a race, but one you could win with enough discipline.
That assumption is breaking. AI has industrialised the discovery and exploitation of vulnerabilities, and the gap between a weakness appearing and being exploited is collapsing.
Set that against remediation measured in days or weeks, and you're not in the same race anymore.
And a growing share of intrusions involve no malware at all: attackers log in with valid credentials and use the tools already on the system. You can't patch a legitimate login.
You can no longer patch fast enough to stay ahead. That means at any given moment, something exploitable is likely to be open - so a breach is no longer something you prevent outright. It's something you manage the odds of.
Lower the odds, limit the damage
If you can't prevent every breach, security splits into two jobs:
- Lower the odds that one happens
- Limit the damage when one does
Security programs often pour almost everything into the first and treat the second as an afterthought. That made sense when prevention was winning. It isn't anymore.
The two jobs - prevention and containment - need different work. Lowering the odds means shrinking what an attacker can reach and closing the gaps you find, fast. Limiting the damage means making sure that when something does get in, it can't move freely to everything else.
Here's how the two fit together.
The rest of this guide walks through techniques to prevent a breach and contain one if it happens.
Reduce the likelihood: discover and harden
You can't protect what you don't know about. Everything downstream - patching, hardening, segmentation - only works on the assets you're aware of. So the foundation is knowing what you have and where it's weak.
Inventory everything
Not just the managed servers and workstations - the cloud instances, contractor machines, branch-office kit, and IoT that never made it into your CMDB. Attackers reach unmanaged assets first, because anything you're not tracking is unmonitored, unpatched, and unsegmented.
Use both active and passive discovery to find everything on the network. Continuous discovery across cloud, on-prem, and remote is the baseline.
Assess for vulnerabilities
Inventory tells you what you have; assessment tells you where it's exposed. Depth is what matters: an unauthenticated scan only sees the surface, while an authenticated scan sees the real state of the host, such as missing patches and weak configuration. Perform authenticated or agent-based scans wherever you can.
Close unnecessary exposure
The cheapest vulnerability to manage is the one you removed. Close every unused service, port, and account.
This is also the layer that fights back hardest, because reducing exposure means turning things off, and turning things off means someone has to confirm nothing depends on them. That friction is why it's the most skipped step, and why attackers keep finding forgotten services to walk through.
Done well, this phase shrinks the number of ways an attacker can get in. But it never gets you to zero - which is why the next phase matters.
Reduce the likelihood: remediate what's left
Discovery and hardening shrink your exposure, but they don't close the vulnerabilities that remain. Those still need fixing - and the window to fix them is getting shorter.
Patch faster
When exploits land in hours and your patch cycle runs in weeks, that gap is the attacker's opportunity. Prioritise the exploitable vulnerabilities first - those are the ones being used to get in.
Automate the bulk of your patching wherever you can; the manual, change-window-bound approach can't keep pace on its own. The low-hanging fruit is third-party software like browsers, which introduce most of the vulnerabilities.
Patching always raises the fear of breaking something. But a missing patch is a bigger risk than a broken one.
Virtual patch the rest
Some things can't be patched in time, or at all: the legacy system, the fragile application, the vendor with no fix available, the change window weeks away. For those, put a control in front of the vulnerability - a WAF rule, an IPS signature, a compensating control. It buys you time without touching the asset.
The point isn't to patch everything, because you won't. It's to close what you can, fast, and shield what you can't - so the exposure that remains is as small and as short-lived as possible.
Limit the impact: contain the spread
Everything so far lowers the odds of a breach. None of it gets you to zero. So the last question is the one security programmes should plan for: when something does get in, how far can it go?
On a flat network, the answer is: everywhere. One compromised host - a phished laptop, an unpatched box, a stolen credential - and the attacker moves freely to the systems that actually matter. The initial breach is rarely the crown jewel. It's the foothold they move from.
Microsegmentation
Microsegmentation limits that movement. Instead of trusting everything inside the network by default, you enforce least-privilege access between systems - each one can only reach what it genuinely needs to.
A compromise in one place can't spread to everything else, because the paths simply aren't there. It doesn't matter how the attacker got in - an exploit or a stolen login still can't reach what it was never allowed to.
Microsegmentation is the step that decides the damage from a breach. When every other control has failed - and eventually one will - microsegmentation is what's left standing between a compromised host and the rest of the network.
It's also the layer most organisations underbuild. Segmentation is harder than patching: it means understanding how systems actually talk to each other before you can safely restrict them, and getting it wrong breaks things. That difficulty is exactly why so many networks stay flat - and exactly why lateral movement remains the attacker's most reliable tool.
Final thoughts
Prevention used to be enough because it could keep pace. It can't anymore. When attackers move in minutes and remediation takes days, some exposure is always open - and the question stops being whether you'll be breached and becomes how far it spreads when you are.
That doesn't mean giving up on prevention. Discovery, hardening, and fast remediation still lower the odds. But the odds never reach zero, and the organisations that come through the next few years won't be the ones that patched fastest. They'll be the ones that assumed breach and built for containment, so a single compromise couldn't become a catastrophe.
Reduce the likelihood. Limit the impact. You need both.
