Edge appliances: what is your actual patch SLA, and can you meet it?

The last three years have made edge devices the reliable way in. Off the top of my head, all publicly documented and all exploited in the wild: Ivanti Connect Secure CVE-2023-46805 and CVE-2024-21887 in January 2024, Palo Alto PAN-OS GlobalProtect CVE-2024-3400 in April 2024, FortiOS SSL-VPN CVE-2024-21762 in February 2024, Cisco IOS XE web UI CVE-2023-20198 in October 2023, Check Point CVE-2024-24919 in May 2024, and Citrix NetScaler CVE-2023-4966 in October 2023.

Every one of those needed action in days. Our change process was built for months. What does yours say now, and more importantly, have you tested it?

We split the estate. Internet-facing appliances have their own SLA: 72 hours for actively exploited, emergency change board that is two named people and a phone call. Everything else stays on the normal cycle. Splitting it was the only way to get the business to accept the fast lane, because it is small enough to reason about.

Ours is 48 hours for anything on the CISA KEV list that faces the internet. We tested it deliberately in a fire drill with a fake advisory and failed the first time, because the person with the change approval authority was on leave with no delegate. That was worth finding out in a drill.

The uncomfortable part for us was not patching speed but inventory. We could not answer 'do we have any of these, and where' fast enough. We fixed the inventory before we fixed the process, and that turned out to be the real project.

Inventory first is the right answer and it is the one nobody wants to hear. Thanks all, this is roughly the consensus I was hoping to sanity check.