Patch Debt and Shared Passwords Are Balance-Sheet Risk

The Decision in Front of You

Every company carries security debt. Some servers run software with published flaws. Some vendor portals and admin consoles still accept a password alone. Some service accounts share one password that has not changed in years. The decision is whether that debt stays an engineering backlog item or becomes a liability with a value, an owner, and a payoff schedule.

The cost of leaving it alone is now well measured. IBM's 2026 Cost of a Data Breach study put the average breach at $4.99 million globally and $11.5 million in the United States, both records ¹². Breaches that took longer than 200 days to contain averaged $5.65 million, against $4.32 million for those contained sooner ².

The two largest US breaches of 2024 did not require novel attacks. One entered through a remote access portal that lacked multifactor authentication, or MFA, the second check beyond a password. The other used passwords stolen years earlier from customers' own computers. Both were preventable with controls the victims already knew about.

What's Happening

Known flaws are now the most common way in

Verizon's 2026 Data Breach Investigations Report found that exploitation of software vulnerabilities was the initial access route in 31% of breaches, overtaking stolen credentials for the first time in the report's 19-year history ³. A year earlier, the 2025 edition had put exploitation at 20%, a 34% jump over the prior report, across 12,195 confirmed breaches ⁴. Edge devices and VPNs, the gateways that connect a company to the internet, accounted for 22% of exploitation actions in the 2025 data, up from 3% the year before ⁴.

Patching is falling behind. In the 2025 report, only about 54% of edge device and VPN vulnerabilities were fully fixed during the year, with a median of 32 days to do so ⁴. Coverage of the 2026 report says organizations patched roughly a quarter of their critical vulnerabilities, down from 38%, and the average time to patch grew from 32 to 43 days ⁵. Even the best performers fixed only 30% to 40% of actively exploited flaws within the first week of detection ⁵.

The list of flaws known to be in active use is public. CISA, the US Cybersecurity and Infrastructure Security Agency, maintains the Known Exploited Vulnerabilities catalog, usually called KEV. It grew by 245 entries in 2025, up from 185 added in 2024, and closed the year at 1,484 ⁶. At that size, matching every internet-facing system against it is a routine weekly task.

The federal government already set the standard

CISA issued Binding Operational Directive 22-01 on November 3, 2021 ⁷. It requires federal agencies to fix KEV entries within two weeks, or within six months for older flaws assigned identifiers before 2021 ⁸. The directive explains why: many flaws rated critical on paper are never exploited, so a list of flaws attackers actually use is a better guide to priority than severity scores ⁸. The directive binds only federal agencies, but CISA encourages every organization to use the catalog to set patching priorities ⁸.

Stolen passwords and weak sign-in fill the rest

Third parties are now in the path of half of all breaches. Verizon's 2026 report found a third party involved in 48% of breaches, up 60% from the prior period ³. The 2025 report had already doubled that figure, from 15% to 30% ⁴.

Credential theft has become industrial. Infostealers, malware that copies saved passwords from a browser, are a major supply. In Verizon's 2025 data, 46% of infected systems holding corporate logins were unmanaged personal devices, and 54% of ransomware victims studied had their domains appear in credential dumps ⁴.

MFA is the standard defense against stolen passwords. A Microsoft study of Azure Active Directory accounts found MFA cut the risk of compromise by 99.22% overall and by 98.56% for accounts whose credentials had already leaked ⁹.

Two Cases from 2024

Change Healthcare. On February 12, 2024, attackers used stolen credentials to log in to a Change Healthcare Citrix remote access portal. The portal did not require MFA ¹⁰. Nine days later they deployed ransomware ¹⁰. UnitedHealth Group, the parent, paid a $22 million ransom ¹⁰. Its CEO, Andrew Witty, told the House Energy and Commerce Committee on May 1, 2024, that "this particular server did not have MFA installed" ¹¹.

The cost was historic. UnitedHealth reported a total 2024 impact of $3.09 billion and advanced $9.03 billion in loans to affected providers ¹². In August 2025 the company confirmed that about 192.7 million people had data exposed ¹³. Senator Ron Wyden told Witty the attack could have been stopped with basic security measures ¹¹.

Snowflake customers. Starting no later than April 14, 2024, a group Mandiant tracks as UNC5537 logged in to customer accounts on the Snowflake cloud data platform. Mandiant and Snowflake notified about 165 potentially exposed organizations ¹⁴. At least 79.7% of the accounts the attackers used had credentials exposed earlier, most through infostealer infections on computers Snowflake did not own, some dating back to 2020 ¹⁴. The affected accounts did not require MFA, many credentials had gone unrotated for up to four years, and customers had not limited logins to trusted networks ¹⁴.

AT&T was among those hit. Its July 2024 SEC filing disclosed that call and text records for nearly all of its mobile customers, about 110 million people, were taken from its workspace on a third-party cloud platform between April 14 and April 25, 2024 ¹⁵.

Case	Way in	Missing control	Known cost or scale
Change Healthcare, February 2024	Stolen credentials on a remote access portal	MFA on an internet-facing login	$3.09B 2024 impact; $22M ransom; about 192.7M people affected
Snowflake customers, April 2024	Infostealer-harvested passwords, some years old	MFA; credential rotation; network allow lists	About 165 organizations notified; AT&T records for about 110M customers

Source: The Register ¹⁰, HC Innovation Group ¹¹, Becker's ¹², Business Insurance ¹³, Mandiant via TechTarget ¹⁴, Security Affairs coverage of AT&T SEC filing ¹⁵.

Why the Usual Approach Fails

Security hygiene is usually funded as operating expense and measured as activity. A monthly report says how many scans ran and how many patches shipped. It rarely says how many internet-facing systems still carry a flaw on the KEV list, or how many logins still accept a password alone. Leadership sees effort and cannot see exposure.

Patching competes with revenue work. Every patch needs testing, a maintenance window, and someone to apply it. Teams defer the ones that look risky to deploy, which often means the edge devices and legacy servers attackers target most. The 2026 Verizon data shows that backlog growing ⁵.

Exceptions outlive their reasons. Change Healthcare's breach turned on one server without MFA ¹¹. Most large organizations have a similar list: a vendor portal, a legacy app that cannot take MFA, a break-glass account. Each exception was approved once and never reviewed.

Shared and standing credentials hide in automation. Service accounts, API keys, and database passwords often live in scripts and configuration files, shared by several people and never rotated. The Snowflake victims were compromised with passwords up to four years old ¹⁴. Standing administrator rights compound the damage, because any stolen admin login reaches everything at once.

Audit trails are left off to save money or effort. Without logs of who signed in and what they touched, a company cannot say what was taken, which lengthens containment and raises the bill. IBM's data ties longer breach lifecycles to higher cost ².

The Framework: The Hygiene Ledger

Finance already knows how to manage a liability: measure it, assign it, schedule its retirement, and review the balance. The Hygiene Ledger applies that discipline to the five gaps behind most costly breaches.

Liability	How to count the balance	Target	Evidence for the board
Known exploited vulnerabilities past deadline	Systems with a KEV entry unpatched beyond 14 days, internet-facing first	Zero past deadline	Weekly scan matched against the KEV catalog 68
Logins without MFA	Internet-facing applications, remote access, vendor portals, and cloud consoles that accept a password alone	Zero, with phishing-resistant MFA for administrators	Identity provider report; list of approved exceptions with expiry dates
Shared or unrotated credentials	Passwords and keys used by more than one person, or older than policy allows	All secrets in a vault, rotated on schedule	Vault inventory; age report for every secret
Standing administrator access	Accounts with permanent admin rights	Admin rights granted per task, with expiry	Monthly access review signed by system owners
Systems without audit trails	Critical systems not sending sign-in and data-access logs to central storage	Every critical system logging, retained at least one year	Log coverage report

Source: author's framework. Targets draw on CISA BOD 22-01 timelines ⁸ and the controls missing in the 2024 cases ¹⁰¹⁴.

Each row produces a single count, and that count is the liability balance. The CFO reviews the five balances monthly, the same way finance reviews aged receivables, and asks why any balance grew.

Exceptions are allowed and priced. A system that cannot take MFA gets a named owner, a compensating control such as a network restriction, and an expiry date. An exception without an expiry counts as an open liability.

What the ledger is worth

The following is the author's illustrative estimate for a hypothetical mid-size US company. Assume a hygiene program costs $500,000 a year in staff time and tooling, and use IBM's 2026 US average breach cost of $11.5 million ¹. The program pays for itself if it lowers the annual probability of a breach by about 4.3 percentage points ($500,000 divided by $11.5 million). Given that MFA alone cut account compromise risk by more than 99% in Microsoft's data ⁹, and that the two largest 2024 breaches each turned on a single missing control, that threshold is modest. Real breach costs vary widely by industry and size, and the probability reduction cannot be measured precisely.

Costs, Risks, and Tradeoffs

Area	Cost or risk	Mitigation
Patch disruption	Fast patching occasionally breaks an application or forces an outage	Test KEV patches on a small group first; keep a short, documented emergency window
Legacy systems	Some older systems cannot be patched or cannot take MFA	Isolate them behind a gateway that enforces MFA; set a retirement date
User friction	MFA prompts and per-task admin rights slow people down	Use phishing-resistant methods with fewer prompts; grant admin access quickly through an approval workflow
Tool spend	Vaults, identity tools, and log storage add licensing and storage cost	Start with internet-facing systems and administrators; size log retention to legal need
Vendor dependence	Third parties involved in about half of breaches sit outside your direct control 3	Require MFA, logging, and patch timelines in contracts; review vendor access quarterly
False comfort	A ledger at zero can miss new systems nobody inventoried	Reconcile the ledger against the asset inventory monthly
When this is wrong	A small firm with no servers of its own, running entirely on SaaS, has little to patch and few secrets to vault	Enforce MFA on every SaaS account, use a password manager, and rely on vendor patching and contracts

Source: author's analysis, with references as cited.

How to Act

Window	Actions	Owner	Milestone
First 30 days	Match every internet-facing system against the KEV catalog. List every login that accepts a password alone.	CISO or security lead	Opening balances for all five ledger lines reported to the CFO
First 30 days	Turn on MFA for remote access, cloud consoles, and every administrator account.	IT operations lead	Zero internet-facing remote access without MFA
First 90 days	Patch all internet-facing KEV entries and adopt a 14-day KEV deadline. Move shared passwords and keys into a vault and rotate them.	Infrastructure lead with application owners	Zero internet-facing KEV entries past deadline; shared secrets in the vault
First 90 days	Add MFA, logging, and patch timeline clauses to contracts with vendors who hold access.	General counsel with procurement	Top 20 vendors reviewed; renewal terms drafted
First 365 days	Replace standing admin rights with time-limited access. Send sign-in and data-access logs from every critical system to central storage.	CISO with CTO	Under 5% of admins hold standing rights; 100% of critical systems logging
First 365 days	Report all five balances to the board audit or risk committee each quarter.	CFO with CISO	Four quarterly reports delivered; every exception carries an expiry date

Source: author's recommendation. The 14-day deadline follows CISA BOD 22-01 ⁸.

Questions to Ask Your Team

1. How many of our internet-facing systems have a flaw on CISA's KEV list right now, and for how long?
2. Which logins still accept a password alone, including vendor portals and remote access?
3. How many credentials are shared between people or service accounts, and when were they last changed?
4. Who holds permanent administrator rights, and why?
5. If we were breached tonight, could we tell from logs what was accessed?
6. Which approved security exceptions have no expiry date?
7. What do our contracts require of vendors who can reach our data?

Closing

Change Healthcare and the Snowflake victims had the controls they needed within reach, and the gap cost billions ¹²¹⁵. Unpatched known flaws and unprotected passwords are liabilities with a measurable balance. Put the five on a ledger the CFO reviews, give each an owner and a deadline, and fund their retirement before an attacker collects on them.

---