--- title: LP - Vulnerability Whitepaper description: 43 days to patch. 60-70% of known-exploited vulnerabilities still open a week later. Get the tactical playbook for closing the exploit path on assets you can't patch on the attacker's timeline — plus a boardroom risk-acceptance template and vendor security checklist. --- [![netfoundry-logo-no-tag-color-horizontal@3x](https://info.netfoundry.io/hs-fs/hubfs/netfoundry-logo-no-tag-color-horizontal@3x.png?width=582&height=174&name=netfoundry-logo-no-tag-color-horizontal@3x.png "netfoundry-logo-no-tag-color-horizontal@3x")](https://www.netfoundry.io) TACTICAL PLAYBOOK · SECURITY & IT OPS # Every unpatched CVE becomes "accepted risk." *It doesn't have to.* The gap between a disclosed vulnerability and a deployed patch is widening every year — and the assets stuck in that gap are exactly the ones attackers go after first. Get the step-by-step playbook for closing the exploit path without waiting on a patch, a change window, or a budget cycle. [Download the Free Playbook Below 👇](https://info.netfoundry.io/lp-vulnerability-whitepaper#get-report) ![vulnerability patching playbook](https://info.netfoundry.io/hubfs/thumb-vulnwhitepaper-cover.jpg) 43 days median time to close a known-exploited vulnerability 60–70% of known-exploited flaws still open a week after detection 26% of known-exploited vulnerabilities reach full remediation WHO IT'S FOR ## Written for the people who own or influence the risk register Security writes the risk-acceptance memo. This playbook is for whoever has to actually close the exploit path underneath it. CISO ### An indefinite waiver isn't a control an auditor wants to see twice. Reclassify accepted risk as compensated risk with an access log instead of a memo re-justified every quarter. IT Ops ### Not every CVE deserves an emergency change window. Close the exploit path in minutes, then patch the underlying system on your normal maintenance schedule. Security Architect ### Virtual patching is a control that never stops needing attention. An asset that can't be reached doesn't need a signature watching what reaches it. Vendor Risk / Compliance ### "What's exposed to the public internet?" should have a one-line answer. It does, once the asset has no listening port at all. Network Engineering ### ACL sprawl is what happens when nobody trusts removing a rule. Identity-based policy travels with the workload — no rebuild when the network around it changes. Audit Committee ### A risk register should shrink, not just grow. Track time-to-compensating-control against the count of risk with no compensating control at all. WHAT'S INSIDE ## Eight sections. One compensating control you can operationalize this week. From naming the five categories of unpatchable risk to a joint Security + IT Ops workflow mapped to concrete platform steps. 01The Reality of Modern Vulnerability DebtP.2 02The Compensating Control MatrixP.6 03Making Assets Invisible: Zero Trust Overlay NetworksP.9 04The Tactical PlaybookP.11 05Technical Implementation in NetFoundryP.14 06What Changes on the Accepted-Risk RegisterP.16 07The CISO Survival ToolkitP.17 08The TakeawayP.19 FREE 18-PAGE STEP-BY-STEP TACTICAL PLAYBOOK ## Get The Unpatchable Vulnerability Playbook The full compensating-control matrix, the technical mechanics of identity-first reachability, and both ready-to-use templates — ready to apply to your first cloaked asset. The five-category breakdown of what actually resists patching, and why A step-by-step joint Security + IT Ops workflow, mapped to platform actions Boardroom risk-acceptance template and vendor security-review checklist ### About NetFoundry NetFoundry helps businesses secure connectivity between components of their widely distributed workloads, across any set of networks. Founded by the inventors and maintainers of the world's most used open source zero trust software, OpenZiti, NetFoundry's Identity-First Reachability™ enables zero trust connectivity with no VPNs, no open inbound ports, and no firewall changes. ### Contact Us [NetFoundry.io](https://netfoundry.io) [Info@NetFoundry.io](mailto:Info@NetFoundry.io) Copyright © 2026 NetFoundry. All Rights Reserved. Identity-First Reachability™ Copyright © 2026 NetFoundry. All Rights Reserved.