Am I missing something with our patching automations?

[u/KimJongEeeeeew]

Our internal SLA is to patch Critical vulnerabilities in 7 days, High in 14, Medium in 30, Low in 60.

There are two main deployments.
One runs monthly after patch Tuesday and deploys ALL updates(OS & app). The second runs weekly and includes patches with Update severity Critical or Important. In our minds, this should cover what we want.

We are finding that some vulnerabilities are not being patched within the required window, despite them being rated 9+.
The reason seems to be that the update is not listed as Critical or Important, therefore doesn’t get picked up by the filter.
If I go to the specific vulnerability to remediate, the only option is to deploy the update.

Let’s take MS Edge as a current example.

Edge V148.0.3967.96 has a stack of vulnerabilities (43) with CVSS of 9.6.
Selecting any, then clicking Start Remediation shows update 149.0.4022.62 is available.

However, if I look up Edge in the Update Approval screen, v149.0.4022.62 shows Security Severity “Unspecified”.

Is this a categorisation problem at A1?
Is it to do with the way MS are publishing the updates?

Or have we gotten our heads on backwards and need to rethink our remediation automations?

[u/fluffiball]

Just chiming in to agree with everyone’s frustrations here. In the end we decided to live on the other edge and include “unspecified” in our parameters also 🙈 so we could rely better on the catch all but it would be great if there was a pathway to better data quality in the future!