Software vulnerabilities – a hidden threat to businesses

Every company, even a small one, relies on hardware and software – from routers and servers to operating systems and office applications. Unfortunately, each of these components can contain vulnerabilities, or security weaknesses.
Although the term may sound technical, a vulnerability is simply an error or weak point in a system that a cybercriminal can exploit. As a result, even a seemingly minor security flaw can put a company’s business continuity at risk.
In this article, we explain in simple terms how vulnerabilities can affect a business, how cybercriminals exploit them to carry out attacks such as ransomware, and what the potential consequences may be. We will also look at the crucial role of backups, particularly immutable backups, in protecting data and maintaining business continuity.

What are vulnerabilities and why are they a problem?

Vulnerabilities are errors or weaknesses in software and hardware that can be exploited in unintended or malicious ways. Examples include inadequate router security, an operating system flaw, or a vulnerability in a business application.
When a vendor discovers a vulnerability, it will typically release an update or security patch to fix it. The problem arises when a system remains unpatched – the vulnerability can then become an open door for attackers.
The scale of the problem is enormous. In 2023 alone, nearly 20,000 new vulnerabilities were identified across various products, with approximately 31% classified as high or critical severity (ENISA report).
What is more, the number of newly discovered vulnerabilities continues to increase year after year. CERT Polska reported a growing number of vulnerabilities actively exploited by cybercriminals – by the end of 2023, as many as 1,074 different vulnerabilities were being exploited (CERT Polska report).
This means that cybercriminals have a “rich menu” of weaknesses they can target.

Why is this a problem for a business? Imagine that your company uses a popular software application or network device in which a vulnerability has been discovered. If you do not install the available security update, a cybercriminal may exploit the vulnerability to gain access to your network or systems.

It is similar to someone discovering that the lock on your office door is defective – if you do not fix it, a thief can take advantage of the weakness.

How do cybercriminals exploit system vulnerabilities?

Cybercriminals (hackers) are constantly looking for vulnerable points in companies’ digital infrastructure. They use various methods, including scanning the internet for unpatched servers and network devices.Once they discover a vulnerability, they may use it to gain access to a system, for example, by obtaining remote access to a server or executing malicious code on it.Importantly, attackers do not necessarily need to discover new vulnerabilities. Many attacks rely on known vulnerabilities that are still unpatched. As noted in the ENISA report, cybercriminals often exploit old, well-documented security flaws. There is no need to invest in developing new intrusion methods when there are still countless known and unresolved vulnerabilities in corporate systems.In other words, when companies neglect security updates, they make the attackers’ job much easier.

Example attack scenario: Imagine a company has a publicly accessible server or application, such as a corporate website, mail server, VPN, or even a standard office router.The software running on the system contains a vulnerability that has been publicly known for several months, but the company has not installed the available security patch.A cybercriminal uses an automated scanner to identify the vulnerable software version and then launches an exploit – specialized code designed to take advantage of the vulnerability and gain unauthorized access to the system.The attacker may then gain full control of the server or network. From there, they can potentially steal data, install malware, encrypt files, or monitor the company’s activities.

Corporate networks in the crosshairs

It is worth emphasizing that vulnerabilities affect not only computers and servers, but also network devices such as routers, firewalls, switches, and Wi-Fi access points.These devices often operate “behind the scenes,” and their updates tend to receive less attention. This is a mistake, because a successful attack on a router or firewall can provide cybercriminals with a gateway into the entire corporate network. According to a joint report by international cybersecurity agencies, including the U.S. Cybersecurity and Infrastructure Security Agency (CISA), more than half of the vulnerabilities most frequently exploited in 2023 affected network devices and infrastructure. In other words, vulnerabilities in routers and similar equipment are being widely exploited by attackers.This statistic highlights how important it is to keep network devices up to date – not just computers and servers.

From vulnerability to attack – what threats does a business face?

When a cybercriminal discovers and exploits a vulnerability, the consequences can be very serious. An attack can take different forms, depending on the attacker’s intentions. Here are the most common scenarios:

• Ransomware attack (extortion through data encryption): This is currently one of the greatest cybersecurity threats. After gaining access to a company’s systems, criminals deploy ransomware that encrypts corporate files – from documents and databases to entire virtual servers. The data becomes a hostage: the company loses access to its files, while ransom demands appear on computer screens in exchange for decrypting them. Ransomware is particularly destructive and can paralyze the operations of virtually any organization, from a small office to a large manufacturing facility. Unfortunately, the number of such attacks continues to increase year after year. In 2023, CERT Polska recorded 161 ransomware incidents in Poland, nearly twice as many as the previous year. Importantly, victims include private companies of all sizes, as well as public institutions and individuals.
• Data theft (data breach): Exploiting a vulnerability can allow attackers to steal sensitive company data, such as customer databases, financial information, intellectual property, or employees’ personal data. Such theft can result in information being leaked online or sold on the dark web. For a company, this can mean the loss of trade secrets, potential penalties – for example, for violating GDPR if personal data is exposed – as well as significant reputational damage. Customers may lose trust if their personal information is compromised.
• Sabotage and business disruption: Sometimes the goal of an attack is simply to disrupt a company’s operations. Criminals may delete important files, disable servers or entire systems, launch so-called wiper attacks designed to destroy data, or cause equipment failures. If the victim is a manufacturing company, an attack could bring a production line to a halt. If it is an e-commerce business, its website could become unavailable, preventing sales. Even a short-term outage can result in significant financial losses. According to available analyses, exploitation of software vulnerabilities became the most common initial access method for such attacks in 2023, accounting for 38% of breaches – more than phishing or stolen credentials. This demonstrates that failing to patch vulnerabilities can often be the first step toward a serious business disruption.
• Double extortion attacks: It is important to understand that modern ransomware attacks often combine data encryption with data theft. Attackers may threaten to publish the stolen information unless the victim pays the ransom. Even if a company is able to restore its files from a backup, the data breach becomes an additional form of extortion. This puts organizations in an even more difficult position: they must worry not only about restoring their systems, but also about reputational damage and potential legal penalties resulting from the data breach.

Consequences for business operations

• Legal implications: Security incidents can result in significant legal obligations. In the European Union, a personal data breach – such as the exposure of customer data – may need to be reported to the relevant supervisory authority and, in cases of negligence, can result in penalties under GDPR. Regulated companies, such as those operating in the financial sector, may face additional incident-reporting requirements. If an attack results from serious negligence, such as a failure to implement basic security measures, affected customers may even pursue civil claims. In short, the consequences of a cyberattack can continue long after the incident itself has been contained.
• Business downtime: If critical systems are encrypted or taken offline, a company may be unable to operate normally. Employees lose access to essential documents and applications, production may come to a halt, and customers may be unable to receive services. Time is money – every day, or even every hour, of downtime can result in measurable financial losses and missed business opportunities. Data shows that many companies are severely affected by such disruptions – 62% report that a ransomware attack had a significant impact on their operations, often preventing them from fulfilling orders and resulting in lost revenue.
• Financial costs: Cyberattacks can generate enormous expenses. Companies may need to pay for system recovery, digital forensics, and the implementation of additional security measures. If a company decides to pay a ransom, this represents another significant expense. In Poland, the average ransom payment has reached several hundred thousand PLN, while total losses, including downtime, lost opportunities, and operational costs, average approximately PLN 7.6 million per company. More than one in five Polish companies affected by ransomware estimated their losses at PLN 2.8–5.8 million, while one in ten reported losses exceeding PLN 5.8 million. Globally, the average cost of a major cyber incident is estimated at several million dollars. For smaller businesses, such amounts can quite literally mean the difference between survival and going out of business.
• Loss of reputation and customer trust: A security breach can harm a company not only financially but also reputationally. Customers may become concerned about the safety of their data and lose trust in the brand. Business partners may also begin to question whether the relationship is secure. Rebuilding a company’s reputation after a public security incident can be a long and costly process. This may involve hiring PR firms, providing affected customers with complimentary support – such as credit monitoring following a personal data breach – or launching marketing campaigns aimed at rebuilding trust and restoring the company’s reputation.

Backups – the last line of defense for your Data

In the face of the threats described above, a backup can be a lifesaver. It is an additional copy of important data stored separately and available for use if the original data is lost or destroyed. When it comes to ransomware attacks, having up-to-date backups can often determine whether a company survives the incident. If an organization has a secure backup, it can restore its data without having to pay a ransom.Real-world examples show that companies with reliable backup strategies can often recover from an attack relatively quickly. Those without backups, on the other hand, face a dramatic choice: pay the ransom demanded by cybercriminals or lose their data and spend weeks rebuilding their systems from scratch. Unfortunately, the reality is that many victims decide to pay the ransom precisely because they do not have functioning backups or their backup systems have failed.

Important: A regular backup is not enough if it is not properly protected. Experienced cybercriminal groups actively seek out and destroy backups during an attack. This is a common tactic: after gaining access to a network, attackers first locate available backups – for example, on network drives or connected servers – and then delete or encrypt them. Their goal is to eliminate the victim’s recovery options, making the company more likely to pay the ransom. That is why where and how backups are stored is critical.

What is an “immutable backup” and why is it worth having?

This brings us to the concept of an immutable backup. It may sound complicated, but the idea is simple: it is a copy of data stored in such a way that it cannot be modified or deleted for a specified period of time. In other words, even if a cybercriminal gains access to our IT infrastructure, they will not be able to delete or encrypt such a backup. It is somewhat like storing data on a DVD – once the disc has been burned, it cannot be overwritten. In the digital world, this is achieved through specific settings in backup systems or storage solutions, such as time-based write protection, read-only storage, or cloud storage with immutability enabled. Cybersecurity agencies recommend this approach. For example, in its ransomware defense guidance, CISA recommends storing critical data in encrypted, offline backups and, ideally, making them immutable. “Offline” means disconnected from the network – for example, a backup stored on media that is not normally connected to a computer. Immutability means that even an authorized administrator cannot accidentally delete or modify the data – or do so under pressure from an attacker – during the period in which the backup is protected. As a result, even if an attacker manages to penetrate the system, the backup remains untouched and ready to be used for recovery.

Benefits of resilient rackups

• Fast recovery of critical systems and data – A company can quickly restore key systems and data after an attack, minimizing downtime. For example, if a file server is encrypted, the company can use a backup created before the attack and restore the server to operation. The shorter the time between an incident and recovery, the lower the financial impact.
• No need to pay a ransom – Reliable backups eliminate the need to pay cybercriminals to decrypt data. This removes the attackers’ financial incentive and may make the ransomware business model less profitable if more organizations are properly prepared.
• Peace of mind and business continuity – Backups provide peace of mind in the event of a disaster. Whether the cause is a cyberattack, hardware failure, or human error resulting in data loss, the business has a Plan B. For business owners, knowing that a single incident will not wipe out years of work is invaluable.

Finally, it is worth emphasizing that cybersecurity is not solely the responsibility of the IT department. Even without a technical background, an informed business owner or manager can take sensible steps to protect the organization. Understanding that vulnerabilities can lead to real business losses is the first step. The second is implementing basic security measures and appropriate procedures. These steps can significantly reduce the risk of the company becoming the next victim of a major cyberattack making headlines in the media. In the digital world, the old principle still applies: prevention is better than cure. That is why it is worth taking care of security updates and reliable backups today. They are the foundation for greater peace of mind – for both business owners and IT professionals.

If you want to effectively protect your company against cyberattacks and implement reliable backup solutions, contact us today.Our experts will be happy to answer your questions and prepare an individual protection plan tailored to the specific needs of your business.

Article author

Zespół Cloud4you