Don't Let Vulnerabilities Spoil Your Operations: Patch & Update

A security update is available, but production is running smoothly. When everything is in motion, and there's no convenient time to take a system offline, it’s easy to delay that update to another day. But for threat actors, that one extra day may be all the opportunity they need.

The challenge of software vulnerabilities is growing. According to Google Threat Intelligence Group's September 2026 research, the number of vulnerabilities disclosed monthly more than doubled between January and August 2026, increasing from 5,045 to 10,740.

But identifying a vulnerability doesn't always mean a fix is immediately available or easily deployed. Some vulnerabilities lack an available patch, while others require testing, vendor coordination, or scheduled downtime before an update can be safely installed.

For the food and agriculture sector, this creates a particular challenge. Technology supports everything from precision farming and processing equipment to refrigeration, inventory management, and distribution. Taking critical systems offline can interrupt production, delay shipments, or create operational risks of its own.

Meanwhile, attackers continue to exploit known weaknesses. According to Verizon's 2026 Data Breach Investigations Report (DBIR), vulnerability exploitation became the leading initial access method for breaches in its reporting dataset, accounting for 31% of breaches and surpassing credential abuse for the first time.

With more vulnerabilities to evaluate and limited time to apply updates, organizations must understand where they're exposed, which weaknesses present the greatest risk, and how to protect critical operations while fixes are developed and deployed.

This Cybersecurity Awareness Month, the Food and Ag-ISAC is reminding  organizations to Don’t Feed the Attackers by keeping technology current, prioritizing vulnerabilities that matter most, and preventing known weaknesses from becoming costly disruptions.

The Fundamentals: Patch, Update, Protect

Keeping technology updated is one of the simplest ways to reduce preventable cybersecurity risks. Whether you're working in a corporate office, processing facility, warehouse, or on the farm, these five fundamentals provide a strong starting point:

1. Keep Software Updated and Apply Security Patches. Software updates help keep systems current, while security patches address known vulnerabilities that attackers may exploit. Follow established update procedures and prioritize critical security fixes to reduce risk without disrupting operations.

2. Enable Automatic Updates Where Appropriate. Automatic updates help reduce the time systems remain exposed to known vulnerabilities. Enable them for computers, mobile devices, browsers, and business applications when supported. Industrial equipment and operational systems may require testing or scheduled updates to avoid disrupting production.

3. Look Beyond Computers and Phones. Farm management platforms, refrigeration monitoring systems, processing equipment, warehouse technologies, routers, and other connected devices can also contain vulnerabilities. Don't overlook these technologies just because they aren’t at the forefront.

4. Replace Unsupported Software and Devices. Outdated technology can become an easy target when manufacturers stop providing security patches. Identify unsupported systems and develop plans to upgrade, replace, or securely isolate them when replacement isn't immediately possible.

5. Verify Updates Are Successfully Installed. Downloading an update doesn't always mean a vulnerability has been fixed. Some updates fail, require additional configuration, or need a restart. Confirm patches have been successfully applied and report issues that prevent updates from being completed.

These practices help close common gaps in cybersecurity defenses. But with vulnerabilities increasing and operational downtime often difficult to accommodate, organizations must go beyond routine updates to make informed decisions about where, when, and how to address security risks.

Beyond the Fundamentals: Keeping Operations Secure

For food and agriculture organizations, effective patch management isn't simply about installing every available update. It requires understanding which vulnerabilities present the greatest risk, coordinating with operational teams, and implementing protections without unnecessarily disrupting the processes that keep the food supply chain moving.

Prioritize the Vulnerabilities That Matter Most

With thousands of vulnerabilities being disclosed, how do organizations determine which ones to address first?

The good news is that not every vulnerability affects every organization, and only a small fraction of disclosed vulnerabilities are observed being actively exploited. However, identifying the weaknesses that pose an immediate threat is increasingly important.

Organizations can make better patching decisions by combining vulnerability severity with real-world threat intelligence. CISA's Known Exploited Vulnerabilities (KEV) Catalog identifies vulnerabilities with evidence of active exploitation, while the Exploit Prediction Scoring System (EPSS) estimates the likelihood of exploitation within the next 30 days.

For food and agriculture organizations, that intelligence should also be considered alongside operational impact. A vulnerability affecting an internet-facing system, remote access connection, or production-supporting technology may warrant a faster response than one affecting an isolated, lower-risk device.

The goal isn't to patch everything at once. It's to fix the weaknesses most likely to put your operations at risk.

Protect Operational Technology Without Disrupting Production

In food and agriculture, applying a patch isn't always as simple as restarting a computer.

Operational technology (OT), including industrial control systems, processing equipment, automated production lines, and refrigeration controls, often supports processes that cannot be interrupted without careful planning.

An unexpected shutdown or incompatible software update could delay production, affect temperature-controlled operations, or create additional safety and operational concerns.

That doesn't mean these systems should go unpatched. It means cybersecurity and operations teams need to coordinate to deploy updates safely.

Organizations should work with equipment manufacturers and technology providers to identify approved patches, test updates where possible, and schedule maintenance during appropriate operational windows. The National Institute of Standards and Technology's Guide to Operational Technology Security provides additional guidance on balancing security with the reliability and safety requirements of industrial systems.

When immediate patching isn't feasible, temporary safeguards such as restricting remote access, isolating vulnerable systems, and increasing monitoring can help reduce exposure until a permanent fix is available.

Don't Overlook Connected Technology and Third-Party Providers

The modern food supply chain depends on far more than the technology an organization owns and operates directly. Farm equipment may rely on connected software platforms. Processing facilities may use third-party maintenance providers. Cold-storage operations depend on monitoring systems, while distributors use cloud-based inventory and transportation management applications.

Each connection introduces software, devices, and vendors that may require security updates, and a vulnerability in a widely used platform or remote access service can potentially affect multiple organizations across the supply chain. When a vendor manages the technology, it isn't always clear who is responsible for identifying, testing, or applying patches.

Organizations should maintain visibility into the systems they rely on, including third-party applications and externally managed technologies. Establish clear expectations with vendors regarding security updates, vulnerability notifications, remote access, and remediation responsibilities. When patches are unavailable, organizations should work with providers to understand the exposure, identify temporary safeguards, and establish a timeline for a permanent solution.

Make Patching Part of Everyday Operations

For food and agriculture organizations, effective patch management requires ongoing coordination among IT, security, operations, equipment maintenance, and business leadership.

That means knowing which systems exist, who is responsible for maintaining them, and when updates can be safely applied.

Organizations should establish regular processes to review vulnerabilities, prioritize critical fixes, coordinate maintenance windows, and confirm successful installation. Automation can help with routine updates and vulnerability monitoring, while testing and change management procedures can reduce the risk of unexpected disruptions.

When organizations can't apply patches immediately, they should document the exposure, implement temporary safeguards, assign responsibility, and identify when the issue will be addressed. Just as importantly, teams should verify that updates actually resolved the vulnerability. A patch marked as ‘installed’ doesn't necessarily mean every affected system is protected, and patching alone won't remove an attacker who has already compromised a system.

Regularly reviewing overdue critical patches, unsupported equipment, and recurring update failures can help identify problems before they become incidents.

Don't Feed the Attackers: Keep Weaknesses Off the Menu

Threat actors don't always need sophisticated techniques to compromise an organization. Sometimes, they simply take advantage of a vulnerability that has already been identified but hasn't been addressed.

For food and agriculture organizations, the challenge is keeping pace with emerging weaknesses while maintaining the systems and equipment that support daily operations. A disrupted processing facility, unavailable inventory system, or compromised service provider can create consequences that extend well beyond a single device or network.

Strong cybersecurity requires knowing where systems are exposed, prioritizing vulnerabilities that pose the greatest risk, and ensuring updates are safely and successfully deployed. Sharing information about actively exploited vulnerabilities and emerging threats through trusted channels, including an ISAC, can also help organizations make more informed decisions.

Throughout Cybersecurity Awareness Month, we've highlighted four practices that work together to protect food and agriculture operations:

• Strengthening passwords and using password managers

• Implementing MFA

• Recognizing phishing and scams

• Keeping systems patched and updated
  

Each addresses a different opportunity attackers look to exploit. Together, they help protect the people, technology, and operations that keep food moving from farm to table. You can read more about their importance and how to defend on our landing page.

Don't let a known weakness spoil your operations. Prioritize the vulnerabilities that matter most, and make cybersecurity maintenance part of everyday business.

Cybersecurity Awareness Month may be coming to a close, but protecting the food supply chain is a year-round responsibility. Don't Feed the Attackers. Keep Your Defenses Fresh.