When vulnerability patches are weeks behind exploitation, your team is too small

A quarterly change window used to be a defence. This month it stopped being one.

CISA's Known Exploited Vulnerabilities Catalog picked up four fresh entries in September. A critical VMware vCenter flaw, patched back in July, is now being exploited by ransomware gangs who joined the attack after the fact. A WatchGuard Firebox firewall vulnerability flagged as far back as December is only now under active exploitation. A Cisco Firewall Management Centre authentication bypass scored the maximum 10.0 on the CVSS scale before it was added. A ConnectWise ScreenConnect flaw joined the same list days later. Four vendors, four different products, one shared pattern: the gap between a patch existing and that patch being exploited in the wild has collapsed from months to weeks.

It gets harder from there. Ransomware gangs are no longer working one vulnerability at a time. They are chaining several together into a single attack, moving from entry to exfiltration inside one change window instead of across several. A quarterly patch cycle was built to close isolated gaps one at a time. It has no answer for a chain, because by the time the first link is patched, the attacker is already through the second.

94% of UK HE IT teams describe themselves as understaffed. That figure is not new, but what it means has shifted under it. A team stretched thin against quarterly patching was already stretched. The same team, now facing exploitation cycles measured in weeks rather than quarters, is being asked to close a gap that is widening every month it stays the same size doing the same job in the same way.

This is not a hypothetical risk sitting somewhere else in the sector. The National Cyber Security Centre now classes 48% of all UK public sector cyber incidents as nationally significant, up from 89 to 204 in a single year. Universities sit inside that classification, not next to it. Separately, new malware strains are combining encryption, data theft and dual-extortion tactics into a single tool rather than three. Research funding and research data are the two things a university actually holds that an attacker wants. The sophistication now visible in the wild points to sustained, targeted access, not opportunistic ransomware.

There is a structural answer to this, and it is not simply hiring more people into a market where 94% of institutions already report being unable to. Infrastructure operated as a managed service gets patched continuously by a team whose only job is patching it — not by an in-house team that is also running this term's return, the timetable and the helpdesk on the same afternoon. Tribal Cloud v3 holds Cyber Essentials Plus certification and ISO/IEC 27001:2022 accreditation today, on infrastructure built for SITS specifically rather than adapted to it after the fact. 33 institutions are already live on Tribal Cloud, 15 of them through completed migrations.

None of this requires a decision today. A Cloud Readiness Assessment is free to every HEFS customer and produces something specific rather than a sales conversation: which vulnerabilities your own estate is carrying right now, and how much faster a managed platform would close each one against your current patch cycle. The Cyber Security and Resilience Bill is still working through the Lords, with implementation not expected until 2028. That's exactly the window in which a free, scoped assessment is easy to justify and a live incident is not.

A Cloud Readiness Assessment goes beyond a high-level review. It provides a detailed understanding of your current infrastructure, identifies vulnerabilities and operational constraints, and benchmarks how a cloud platform could improve security, resilience, and patching responsiveness across your estate.

The question worth putting to whoever actually owns this decision at your institution is a plain one. Is a quarterly patch cycle still a credible defence against a threat that now moves weekly? And if the honest answer is no, does the person who needs to hear that already know it?

See what Tribal Cloud v3 closes.