The patch nobody was assigned

Some servers stay unpatched on purpose: a signed exception, a named owner, a date to look again.

That is a decision. The expensive server is the other kind, the one nobody decided anything about.

The last two posts here covered an email record pointed at the wrong people and a password rule that outlived its evidence. Neither is difficult to fix. Both persist anyway. The question was never technical. It was who owns them.

Four words settle that, and each has one job. Policy is what is required, approved by someone with the authority to enforce it. A standard is the mandatory specifics: the measurable form the policy takes. A guideline is what good looks like where judgment is allowed. A control is the safeguard that actually operates, and leaves evidence that it did.

Left alone, a policy library becomes a garage sale: something from two consultants, something from three predecessors, and a framework the company stopped using in 2019. “Policy” is printed on documents nobody approved. The standards live in somebody’s downloads folder. The guidelines get enforced like law, right up until the week they are inconvenient.

The test is whether a control traces upward. Control to standard, standard to policy, policy to risk, risk to something the business would miss on a Monday morning. Break a link anywhere and the work does not stop. It just stops being anybody’s.

The 2026 Data Breach Investigations Report names exploited vulnerabilities as the most common way into the breaches it studied: 31 percent, up from 20 percent a year earlier.¹ In scanning data from more than 13,000 organizations, only 26 percent of the known-exploited vulnerabilities that turned up had been fully remediated. For those that were, the median time from detection to full remediation rose from 32 days to 43.¹

Known. Published. Listed by CISA as exploited in the wild.² About one in four fully fixed.

The report does not say why the rest stayed open. Some will be signed exceptions, fixes waiting on a vendor, or change windows. Those have owners. But where no standard defines what “current” means for a system, no owner answers for it, and nothing shows anyone looked, the patch was never refused. It was never assigned.

At a dealership, or any company that runs on software it bought, the question is simple. For each system, write one name: your team, your managed service provider, or your software vendor. If the answers point at each other, nobody owns it. A vendor should ask the same question from its side: which customer systems does the contract say you patch?

Execution fails quietly, which is why it survives checkbox audits. A control nobody owns produces the same report as one somebody does.

Take the newest thing your organization bought this year and trace it upward. Control, standard, policy, risk, business outcome. If the chain breaks before it reaches the business, what did you buy?