When a serious vulnerability is published, two races start at once: attackers racing to exploit it, and defenders racing to patch it. Most businesses don't know the race has started. This post is about how we make sure our clients are running before their attackers are.
Every week, security researchers and vendors publish new vulnerabilities — flaws in firewalls, email servers, VPNs, business software. Each one comes with an uncomfortable truth: publication is a starting gun. The moment a vulnerability is public, ransomware crews and access brokers begin scanning the internet for systems that haven't been fixed yet, and the window between "announced" and "actively exploited" keeps shrinking — for the worst flaws it is now measured in days, sometimes hours. A business that patches on a monthly cycle is, for that window, defending itself with information that's a month old.
What is early threat intelligence?
Early threat intelligence means hearing the starting gun: knowing about a newly published or newly exploited vulnerability the moment it matters, not at the next scheduled review. For Key IT's managed cybersecurity clients in Melbourne and beyond, the 24/7 SOC service watches the sources where that signal appears first:
ACSC alerts and advisories
The Australian Cyber Security Centre's warnings about threats being used against Australian organisations right now.
Known-exploited-vulnerability catalogues
Curated lists, such as the one CISA maintains, of flaws confirmed to be exploited in the wild — the difference between "theoretically bad" and "being used against businesses like yours today".
Vendor security bulletins
Microsoft, firewall and VPN vendors, and the business platforms our clients run, announcing flaws in the products we manage.
The threat intelligence built into the SOC tooling
Indicators and exploitation patterns flowing from the security platforms that watch our clients' environments around the clock.
None of these sources is secret. What makes it "intel" is that the 24/7 SOC watches them around the clock, and each one is checked against which clients it actually affects.
Why does threat intelligence need a vulnerability inventory?
An advisory only matters if you know whether it applies to you — and that is the step most businesses miss. "Critical flaw in brand-X firewalls" is trivia unless someone can answer, within minutes, "do we run brand-X firewalls — where, on what firmware, exposed to what?" That answer comes from the continuous vulnerability scanning we run across client infrastructure: it maintains a live picture of every device, operating system and internet-facing service in each environment. When an advisory lands, we don't send a generic "please check your systems" email — we cross-reference the flaw against what we know each client actually runs, and go straight to the environments that are exposed.
How does Key IT respond to a newly exploited vulnerability?
Key IT runs every newly exploited vulnerability through the same five steps. When early intel meets a live inventory, the response is specific and fast:
Match
A new exploited vulnerability is published; the SOC checks it against every client environment. Most clients aren't affected — they hear nothing, and lose nothing to alarm fatigue.
Prioritise
For affected environments, we rank by real risk: is it internet-facing, is exploitation confirmed in the wild, what would compromise cost this business? The Essential Eight sets the benchmark — it expects critical, actively exploited flaws to be patched within 48 hours.
Fix or shield
Usually that means an emergency patch inside an agreed window. When a patch doesn't exist yet, we mitigate — disable the vulnerable feature, restrict access to it, tighten monitoring around it — so the hole is covered while the vendor catches up.
Verify
The next scan confirms the fix actually landed everywhere. "We think we patched it" is not a security posture.
Watch for the ones that got through
Monitoring looks backwards too: if a flaw was being exploited before it was public, the SOC hunts for signs it was already used in a client environment — because finding that early is the difference between an incident and a catastrophe. That's where incident response takes over.
Do attackers really exploit published vulnerabilities that fast?
Yes, and it isn't theoretical. The pattern — vulnerability published, laggards exploited — sits behind many of the incidents that made Australian headlines in the past few years, from perimeter devices to file-transfer tools. We wrote about a live example when the Akira crew went after unpatched SonicWall VPNs: the businesses hit weren't unlucky, they were slow — still exposed after the fix existed. Unpatched VPNs and firewalls are a common front door for ransomware crews (here's what happens during a ransomware attack once they're through it). Early intel exists precisely so our clients are never in that group.
Business websites run the same race. In July 2026 the ACSC warned of a large-scale campaign exploiting known flaws in website content management systems and their plugins, saying many small to medium-sized Australian businesses had been impacted, and it pointed to AI as one reason the gap between a flaw's publication and its exploitation keeps shrinking. Our breakdown of how small business websites are being hacked in Australia lists the plugins named in that alert, plus a checklist owners can run through with whoever manages their site.
Why speed is a system, not a heroic effort
Any IT provider can patch fast once — when a client calls in a panic after reading the news. The point of building intel, inventory, prioritisation and verification into one continuous loop is that fast is the default, for every advisory, whether or not it makes the news. That's also why Key IT delivers threat intelligence and vulnerability management as one managed program rather than a tool: the value isn't the feed, it's the people and process wrapped around it. Your team hears about the flaws that affect you, with the fix already scheduled — not a weekly digest of everything scary on the internet.
Frequently asked questions
We already patch monthly. Isn't that enough?
For routine updates, a monthly cycle is fine. For critical, actively exploited vulnerabilities it is far too slow — the Essential Eight expects those closed within 48 hours, and attackers scan for newly published flaws immediately. You need both: the routine cycle, and a fast lane for the flaws that can't wait.
Where does your threat intelligence come from?
ACSC alerts, known-exploited-vulnerability catalogues, vendor security bulletins, and the intelligence built into the SOC platforms watching our clients' environments — triaged against what you actually run, so only what's relevant to your systems reaches you.
What's the difference between threat intelligence and vulnerability scanning?
Threat intelligence tells you which flaws attackers are using right now; vulnerability scanning tells you which flaws exist in your own systems. You need both to know what to fix first, which is why Key IT runs them as one loop. For a deeper test of how far an attacker could actually get, add penetration testing.
How quickly should critical vulnerabilities be patched in Australia?
Under the Essential Eight, published by the Australian Cyber Security Centre, internet-facing systems should be patched within 48 hours when the vendor rates a flaw critical or a working exploit exists. Less urgent patches can follow a routine cycle. If the framework is new to you, our Essential Eight explained in plain English covers what each control asks for.
What if there's no patch yet for a flaw you find?
We mitigate: disable or restrict the vulnerable component, limit its exposure to the internet, and tighten monitoring around it until the vendor ships a fix. A hole you're watching and have shielded is a very different risk from one nobody knows about.
Does a small business need vulnerability management?
Yes. Attackers scan the whole internet for unpatched devices and don't check company size first, so a ten-person office with an exposed VPN is as easy to find as a large enterprise. That makes the "too small to be a target" belief a myth, and a fast patching lane worth having at every size.
Do we need to be a cybersecurity client for this?
The full loop — intel, scanning, SOC triage, managed remediation — is part of our managed cybersecurity service, with continuous scanning available Australia-wide from $149/month. If you just want to know where you stand today, start with a free health check.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review