Putting Ten Thousand Missing Patches in Context

During a Stage 2 cybersecurity assist visit, an inspection team reported that a submarine had roughly ten thousand missing patches. The commanding officer understandably believed the crew had suffered a broad failure. Nathan stopped the brief and asked for context: how many patches existed overall, how many missing updates were Category 1 security patches, and how many computers were affected. The answers showed that only five Category 1 patches were missing and that the problem was isolated to two of sixty computers, likely because they had stopped receiving WSUS updates. The solution was to remove and reimage those systems. Nathan carried forward the lesson that poorly communicating a problem can be more damaging than the problem itself.

During a Stage 2 cybersecurity assist visit while Nathan served at COMSUBRON 4, an inspection team briefed a submarine commanding officer on patch-compliance findings across the crew's computers.

The headline figure—roughly ten thousand missing patches—made the condition appear to be a broad crew failure. Without the total population, security severity, and number of affected systems, the statistic could create unnecessary alarm and drive the wrong corrective response.

Nathan stopped the brief and asked how many patches existed overall, how many missing updates were Category 1 security patches, and how many computers were affected. The answers narrowed the issue to five Category 1 patches on two of sixty computers, likely because those systems had stopped receiving WSUS updates.

A large number is not yet a useful explanation. Technical leaders must provide denominator, severity, scope, and likely cause so decision-makers can distinguish systemic risk from an isolated fault and act proportionately.