As cyber threats grow more sophisticated, the ability of organisations to defend themselves depends heavily on their vendors’ speed and efficiency in addressing known, published vulnerabilities. Often referred to as CVE’s.
One key aspect that often gets overlooked in discussions about protecting networks is how quickly vendors identify and resolve software vulnerabilities and of course the volume, or how many per month or per year are reported.
Recent data from industry analysis highlights intriguing trends among leading vendors: Check Point Software, Fortinet, Cisco, and Palo Alto Networks (PAN). This comparison sheds light on their performance in addressing vulnerabilities and fixing critical issues, helping cybersecurity leaders make informed decisions. While all vendors bring valuable solutions to the table, Check Point Software stands out with the fewest vulnerabilities and the fastest average fix times.
Key Vulnerability Insights
Check Point Software (market cap $20 billion)
- Total vulnerabilities since 2023: 4
- Average time to fix: 7 days
- Critical/high vulnerabilities: 3, resolved in just 1 day
Check Point’s track record of addressing vulnerabilities quickly makes it a preferred choice for organisations prioritising rapid response and resilience. With fewer vulnerabilities to manage, they demonstrate a proactive approach to cybersecurity patch management.
Fortinet (market cap $76 billion)
- Total vulnerabilities since 2023: 139
- Average time to fix: 6 days
- Critical/high vulnerabilities: 54, resolved in an average of 13 days
Although Fortinet reports more vulnerabilities, it performs reasonably well in terms of fix time. However, the larger volume suggests that Fortinet users may need to monitor and patch systems more frequently, potentially increasing the workload for IT teams.
Cisco (market cap $234 billion)
- Total vulnerabilities since 2023: 46
- Average time to fix: 15 days
- Critical/high vulnerabilities: 20, resolved in an average of 21 days
Cisco’s performance shows a mixed bag. While their fix times for critical vulnerabilities are better than most, the overall time to fix general vulnerabilities is slower than Check Point and Fortinet.
Palo Alto Networks (market cap $118 billion)
- Total vulnerabilities since 2023: 50
- Average time to fix: 18 days
- Critical/high vulnerabilities: 10, resolved in 82 days on average
PAN’s critical vulnerability fix time raises concerns. For organisations needing swift resolutions, the extended timeline may be a disadvantage.
The Importance of Fix Times in Cyber Security
Fast response times for addressing vulnerabilities are crucial for several reasons:
- Mitigation of risk: The longer a vulnerability remains unpatched, the greater the chance that it will be exploited by attackers.
- Regulatory compliance: Industries such as finance and healthcare are required to adhere to strict regulations concerning the patching of security vulnerabilities.
- Reputation management: A data breach caused by a known vulnerability can damage customer trust and the organisation’s reputation.
Caveats to Consider
It is essential to consider the context behind these numbers. For example:
- Fortinet’s high vulnerability count could reflect its broader market share and diverse product range. The more products a vendor has, the higher the likelihood of vulnerabilities being reported. However, this does not negate the fact that the time to fix critical issues is still longer compared to Check Point.
- Cisco’s shorter timelines for fixing critical vulnerabilities might appeal to organisations where high-risk issues are the priority. Yet, their longer overall fix times suggest a slower response to less severe issues.
- Check Point’s low vulnerability count demonstrates the advantage of a focused product line and proactive security measures. While they have fewer vulnerabilities, their rapid response times highlight a commitment to minimising risks.
Why These Findings Matter for Cybersecurity Leaders
Chief Information Officers (CIOs), Chief Technical Officers (CTOs), and other cybersecurity decision-makers need to weigh these factors carefully when selecting vendors. By choosing a vendor that aligns with their organisational needs, they can:
- Ensure faster mitigation of threats.
- Reduce the workload on IT teams.
- Maintain compliance with industry regulations.
Impartial Analysis
At ITogether, we pride ourselves on providing unbiased insights to our customers. While Check Point Software emerges as a strong performer in this analysis, we remain committed to helping organisations find solutions that best meet their specific requirements. Whether it’s a vendor with fewer vulnerabilities or one with faster response times for critical issues, the choice should be guided by a comprehensive understanding of risks and priorities.
Interested in learning more? Click here to book a chat or call us on 0113 341 0123.
0 Comments