⏱ 4 min read
Key Takeaways
- A defense in depth strategy is no longer optional — it’s the only architecture that holds when patching alone fails.
- Nearly 40% of all intrusions in Q4 2025 were caused by exploited vulnerabilities — not phishing, not credential theft.
- Some zero-days were weaponized within hours of public disclosure, making patch-first strategies obsolete as a primary defense.
- FIRST is forecasting 50,000+ published CVEs in 2026 — the math no longer favors organizations relying on a single layer of protection.
- Defense-in-depth is the only viable answer — TC21-05, TC21-06, TC21-17, and TC21-00 work together precisely because any one of them can fail.
- The most resilient organizations in 2025 weren’t the fastest patchers — they were the ones with the deepest layered defenses.
There’s a number buried in the latest cybersecurity forecasts that should fundamentally change how every organization thinks about vulnerability management: 40%. According to Cisco Talos, nearly 40% of all intrusions in Q4 2025 were caused by exploited vulnerabilities — not phishing, not credential theft, not insider threats. Exploited vulnerabilities — the kind with CVE numbers and, theoretically, patches already available. And here’s what makes that number worse: FIRST is now forecasting more than 50,000 published CVEs in 2026, with some scenarios projecting closer to 100,000. More alarming still, multiple zero-days this year were weaponized within hours of public disclosure. Hours. The math no longer works in your favor if “patch as fast as possible” is your security strategy.
Why a Defense in Depth Strategy Beats Patching Alone
When a critical vulnerability drops on a Tuesday and threat actors have a working exploit by Tuesday afternoon, your patch cycle — no matter how disciplined — is no longer a primary line of defense. At that point, it’s cleanup.
This isn’t an argument against patching. Patching is essential, and TC21-05: Security Updates & Patch Management is a cornerstone of the TOPCYBER21™ framework for good reason. Organizations that skip it are inviting unnecessary, avoidable risk.
But patching is one layer of protection — not the whole stack. And treating it like the whole stack is exactly the kind of thinking the 40% stat is calling out. The organizations that fared best when zero-days hit in 2025 weren’t the ones who patched the fastest. They were the ones who had multiple layers already in place — so that when exploitation happened before a patch arrived, other controls caught the attacker before damage could spread. That’s the essence of defense-in-depth, and it’s the foundational principle behind every one of the 21 TOPCYBER21™ best practice areas.
What Defense-in-Depth Actually Looks Like
No single control stops every attack. The TOPCYBER21™ framework is built around that reality. When a zero-day lands faster than your team can respond, here's how layered depth works in practice:
TC21-00: Risk Assessment means you already know your highest-value assets and your exposure surface — so when a critical CVE drops, your team knows exactly where to look first.
TC21-06: Endpoint Security & EDR catches behavioral anomalies even when there's no existing signature for the exploit yet. Behavior doesn't lie, even when the malware is brand new.
TC21-17: Managed Detection & Response (MDR) keeps trained analysts actively hunting for attacker behavior around the clock — not just waiting for automated alerts that may never trigger on a novel technique.
TC21-13: Network Security & Advanced Threat Protection limits lateral movement if an attacker does establish initial access, containing the blast radius before a foothold becomes a full breach.
TC21-04: Identity & Access Management makes privilege escalation harder even after successful exploitation — because most attackers can't do real damage with just the access they start with.
None of these layers guarantee a perfect outcome on their own. Together, they make it dramatically harder for attackers to turn an exploited vulnerability into a business-defining event.
What Your Organization Should Do Right Now
- Start with risk assessment: You cannot prioritize patching intelligently without knowing which assets carry the most exposure and the highest consequence if compromised. TC21-00 is the foundation everything else is built on — and it's the first step in any serious defense-in-depth program.
- Audit your detection capabilities honestly: If a zero-day hits on a Tuesday, would your team have visibility into the resulting behavior by Wednesday? If the answer is "we'd find out when something stopped working," you have a detection gap that patching alone will never fill.
- Stop thinking about patching as a security program: It's a component of one. The 50,000 CVE forecast for 2026 isn't designed to paralyze anyone — it's a forcing function to stop treating single-layer security like a viable strategy. The window between disclosure and exploitation is now measured in hours, not weeks. Your defense needs to be deeper than the window is wide.
40%
of all intrusions in Q4 2025 were caused by exploited vulnerabilities — not phishing, not stolen credentials. Known vulnerabilities. With patches available. That's a strategy problem, not a patching problem.
Source: Cisco Talos Intelligence
Ready to STOP the #CYBERinsanity?
The window between disclosure and exploitation is now measured in hours. Find out where your organization's depth stands — free, in 15 minutes.
About the Author
Matt Tankersley, CISSP is a US Navy combat veteran, Founder & CEO of TechOnPurpose, and creator of the TOPCYBER21™ Framework. With 35+ years in IT and cybersecurity, he helps organizations STOP the #CYBERinsanity and build real, layered protection that works.
About TechOnPurpose
At TechOnPurpose, we help organizations move from under-resourced and "stuck in the cybersecurity headlights" to fully supported and protected in hours or days—not weeks. Through comprehensive IT support and our TOPCYBER21™ framework, we assess cyber risk in 15 minutes and build defense-in-depth protection fast. As a veteran-owned MSSP and globally recognized Top 250 provider, we don't just support and secure—we elevate the role of trusted technology partner.
