Vulnerability Management Programme Ransomware Near Miss

The client ran a tightly regulated financial‑services operation with 180 staff across three offices in Riyadh, Jeddah and Dammam. Their technology stack combined on‑premise Windows servers, legacy Unix systems and cloud‑based SaaS applications that support retail banking, wealth management and payments processing. The regional threat environment featured ransomware groups such as REvil and LockBit, as well as nation‑state actors using credential‑stuffing and supply‑chain attacks. Similar pressures are being felt across the GCC, including the UAE, where banks face the same ransomware campaigns and state‑backed intrusion attempts.

The organization relied on a basic vulnerability scanner that ran only quarterly, and the reports were never triaged. Patch management was a manual process for Windows updates, leaving critical gaps on systems that were not monitored. Because there was no central asset inventory, newly provisioned virtual machines and container workloads slipped off the radar, creating blind spots that attackers could exploit.

Compliance pressure rose after the Saudi Central Bank issued tighter SAMA cyber‑risk guidelines. The new rules require continuous vulnerability assessment and remediation of high‑severity findings within 30 days. The board, already uneasy after a ransomware near‑miss, demanded proof of a systematic programme that could show measurable risk reduction. Non‑compliance could trigger heavy fines and jeopardise the firm’s licence to operate in the financial sector.

The business impact was clear. Product releases slowed as developers hesitated to push code without confidence that the underlying infrastructure was secure. Customer confidence dipped, reflected in a modest rise in churn during the quarter following the incident. The organization concluded that without an automated vulnerability‑management programme it could not sustain growth or meet regulatory expectations.

Discovery and Assessment

We started asset discovery with Qualys AssetView and Rapid7 InsightVM to map physical, virtual, and cloud resources. The scan uncovered 312 assets, including 27 legacy Unix servers that had not been recorded. A risk‑scoring model weighted asset criticality, data sensitivity, and exposure to external networks. The process was aligned with UAE NESA guidelines and GCC cyber‑risk frameworks.

Stakeholder Alignment

A governance board was created with IT, compliance, risk, and business‑unit leaders. Workshops clarified SAMA remediation timelines and set service‑level agreements for each severity tier. Ownership was recorded in ServiceNow, linking vulnerability tickets to configuration items and change‑request workflows, meeting TDRA expectations for accountability.

Architecture Design

The design follows a layered approach: continuous discovery feeds Tenable.io, which runs scheduled scans across network segments. Findings are normalized and enriched with threat intelligence from Recorded Future. Prioritization logic combines CVSS scores, exploitability data, and internal asset criticality, then pushes a dynamic remediation queue into ServiceNow. All data handling respects GCC data‑residency requirements.

Tool Selection

Qualys was chosen for its patch‑validation capabilities on Windows and Linux hosts. Tenable.io provided the flexibility to scan cloud workloads and container images. ServiceNow served as the central ticketing and workflow engine, delivering audit trails and satisfying reporting obligations. Integration scripts written in Python and PowerShell automate ticket creation and closure, reducing manual effort.

Phase 1 - Foundation

The foundation phase focused on establishing a reliable asset inventory. Agents were deployed on all Windows servers via Group Policy, while SSH keys facilitated agent‑less scanning of Unix hosts. Baseline scans captured 95 % of known assets; the remaining gaps were filled through manual verification and network‑traffic analysis.

Phase 2 - Core Implementation

Automated weekly scans were scheduled in Qualys, targeting external‑facing services and internal high‑value segments. Findings were exported via API to Tenable.io, where custom prioritisation rules flagged any CVE with an active exploit as Critical. ServiceNow workflows automatically generated remediation tickets, assigned them to the responsible system owners, and escalated overdue items after three business days.

Phase 3 - Hardening and Optimisation

Hardening scripts, built with Ansible, applied vendor‑recommended configurations to Linux servers, reducing the attack surface. Patch management was synchronised with Microsoft WSUS for Windows updates, ensuring that critical patches were deployed within 48 hours of release. Continuous monitoring dashboards in Splunk visualised remediation progress, alerting the security operations centre when remediation SLAs were at risk. Regular tuning sessions refined scoring thresholds, decreasing false‑positive tickets by 42 %.

The programme delivered a 78 % reduction in critical vulnerabilities within the first quarter, bringing the organisation well below the SAMA threshold of 5 % critical exposure. Mean time to remediation fell from 45 days to 12 days, enabling the firm to meet the 30‑day regulatory window for high‑severity issues. Alert volume in Splunk decreased by 35 %, allowing the SOC to focus on genuine threats rather than noise. Automation saved an estimated 280 hours of manual ticket handling per month, freeing staff to work on strategic initiatives. The successful audit outcome reinforced client confidence, contributing to a 5 % increase in new account openings in the subsequent quarter.

Lesson 1: Asset Visibility Is Non‑Negotiable

Without a complete inventory, even the best scanning tools miss critical hosts. Early investment in discovery paid dividends by eliminating blind spots.

Lesson 2: Prioritisation Beats Volume

Applying threat‑intel enriched scoring prevented the team from drowning in low‑risk findings, keeping remediation focused on real business impact.

Lesson 3: Integration Drives Compliance

Linking vulnerability data directly to ServiceNow change‑management ensured audit trails were automatically generated, simplifying regulatory reporting.