Back to Patterns Directory
PAT-4403-INC-SECURITYARCHETYPE: Cascading Incentive Distortion

Security Patch Deferral to Preserve Quarterly OpEx

Sub-Type: Corporate IT Security Cost Externalization

VEC:AUTH:0.89COUP:0.74LAT:0.81OVR:0.86
Authority Gradient
0.89
Feedback Coupling
0.74
Telemetry Latency
0.81
Override Suppression
0.86
Structural Pattern Audit Brief
Critical Multi-Node (Level 4)PAT-4403-INC-SECURITY

Executive IT leadership defers known vulnerability patching and SSL inspection renewals to meet quarterly budget targets, gambling that breach events will occur outside their bonus tenure.

Failure Invariant Breach
Vulnerability_Scanner -> IT_Leadership (Patch Deferred) -> Exploiter_Payload -> Data_Exfiltration
Absent Safety Recovery Mechanism
Automated policy-gated continuous patch deployment without executive veto

Fundamental Invariant Rules

INV-01:Critical CVEs scoring $ge 9.0$ must be patched within 72 hours under mandatory automated revocation rules.

Engineered Resilience & Mitigation Strategies

MIT-01:Personal fiduciary liability for CISOs concealing critical unpatched vulnerabilities
MIT-02:Automated immutable dependency patch pipelines

Canonical Incident Manifestations (2)

FTC-DOJ-2017-0907Consumer Credit Reporting & Cyber Infrastructure

Equifax: Unpatched Apache Struts CVE-2017-5638 & Expired SSL Inspection Certificate

Internal patch verification Constraint_Boundary failed. A key Telemetry_Channel (SSL traffic inspection) remained dead for 19 months due to certificate expiration, allowing deep data buffer exfiltration unmonitored.

CISA-ED-2020-01Software Supply Chain & Cyber Security

SolarWinds Orion: SUNBURST Software Build Pipeline DLL Injection

Upstream software synthesis Decision_Node compromised in memory. Valid digital signature telemetry masked code modifications from downstream consumer nodes, breaching global integrity boundaries.

NIST RegistryInspect Dossier →