In IT environments, the general principle is to apply security patches in a timely manner to minimize attack vectors and to prevent risks and potential damages. This has proven to be an effective and important method of "cyber hygiene".

However, this is not always the best approach in OT environments. Why this is the case and how risk-based vulnerability management can be utilized as a pragmatic approach to enhance resilience will be explored in this presentation.