Calm down. · Both
Calm down: the firehose is not your to-do list
I can't remember a time when stuff came at us this fast. Models are finding real vulnerabilities. Vendors ship patch drops long enough to need their own table of contents. And in between, a fresh story every few hours about an AI that "broke out," "went rogue," or is coming for the power grid by Thursday.
Some of it is real. Much less of it is relevant to you.
Real isn't the same as relevant
A model-found bug in a component you don't run is someone else's Tuesday. A critical in something sitting behind three layers of controls is not the same as a critical on your VPN. The only way to tell the difference is to know your own environment:
- What you run: an asset inventory you actually trust.
- What's exposed: what's internet-facing, and what can reach what.
- What's in the way: the compensating controls that change the real risk.
Without that, every patch drop looks equally urgent and you're buried. With it, dozens become the few that matter to you.
Two free aids help with the "is anyone actually using this?" question. CISA's Known Exploited Vulnerabilities catalog is, in CISA's words, "the authoritative source of vulnerabilities that have been exploited in the wild." FIRST's EPSS "estimates the probability that a published CVE will be exploited in the wild in the next 30 days." Neither one knows your environment. That part's still on you.
Stay calm, on purpose
My take: the doom bombardment is optimized for clicks, not for your change calendar. Don't change controls because of a headline. Confirm before you escalate. But don't sit and wait on the vendor, either. Two weeks ago, researchers saw freshly patched Citrix NetScaler appliances crashing on Friday, Oct. 2. Citrix posted interim guidance that day, shipped a bulletin and fixed builds for CVE-2026-88779 over the weekend, and CISA added it to KEV on Sunday. It was the second weekend in a row of emergency NetScaler patching. Fridays are supposed to be for fun, not fixes. If you already know what you run and what's exposed, you can make the call before the advisory lands.
Talking to leadership
Boards, execs, teams and your SOC see the same headlines. They don't need a reading list; they need a consistent answer. Four questions, every time:
- Does it affect us? Do we run the thing, and which version?
- Is it exposed? Internet-facing, internal only, or behind controls?
- Is it being exploited? Is it in KEV? Is the EPSS score high? Is there vendor or credible threat-intel reporting?
- What are we doing, and by when? Patch, mitigate, monitor, or accept, with an owner and a date.
Report it the same way each time: what came out, which items apply to us, what we're doing, and what we decided doesn't apply and why. That last line is what earns trust. "We checked, and it doesn't affect us" is a perfectly good update.
What to do:
- Keep your inventory and exposure map current. It's the filter for everything else.
- Triage with exploitation signals, not adjectives:
- CISA KEV for known exploitation
- EPSS for likelihood
- your own exposure for relevance
- Set a standing format for leadership updates using the four questions, so nobody has to improvise in a panic.
- Write down what you decided not to do, and why.
- Breathe. It's coming faster. It isn't all coming for you.