en
Support
On September 4, the hacker group Rhysida posted approximately 1.44 million files from the Berlin state government on the dark web: emergency plans for water supply, fire department documents, and a directory of framework planning for chemical, biological, and nuclear emergencies. Five days later, IT managers gathered at the Medienhaus Göttingen for the SerNet Forum on the topics of vulnerability management and NIS2. Mitko Dimitrow, Senior Security Consultant at our partner Greenbone, summed it up: “Anyone can find vulnerabilities. Managing them is the real work.”
The pattern he regularly sees with clients: A scanner is purchased because management or an audit requires it. “Buy it, check it off the list, forget about it,” says Dimitrov. The scanner runs anyway and does find something. But no one translates the findings into actions, responsibilities, and deadlines. Five years of license fees later, the risk remains the same. “A scan creates transparency, but it doesn’t reduce risk.”
According to the BSI: 119 new vulnerabilities per day
The figures show just how quickly the backlog is growing. In its 2025 Status Report, the BSI counts an average of 119 newly published vulnerabilities per day—about a quarter more than in the previous year. Much of this remains unaddressed within organizations: the median time to patch is about 43 days, and of the vulnerabilities that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) lists as actively exploited, only about 26 percent are ever patched.
Prioritizing vulnerabilities: Which gap first?
“A company doesn’t have to patch every vulnerability, but at least the important ones—and it needs to do so quickly, because every additional day is one more day for the attacker,” says Dimitrow. He illustrated which ones should be addressed first using two vulnerabilities with an identical CVSS score of 9.8—just below the maximum score of 10 on the standard severity scale. One is located on an isolated test system; the other on a publicly accessible production service. Same score, different priority. The order is determined by further questions: Is the system accessible from the outside? How critical is it to operations? How likely is it that the vulnerability will be exploited soon? No score can make this determination for you; it requires someone who knows the organization inside and out.
Remediation is also more than just patching. Some systems cannot be modified because a line-of-business application depends on them. In such cases, the options are configuration changes, isolation, restrictive firewall rules—or a documented risk acceptance with a deadline. Documentation is the key point: As of December 2025, the NIS2 Implementation Act will apply to affected companies without a transition period. In the event of an audit, a traceable decision is what counts.
From Vulnerability Scan to Process: Consulting by SerNet
This is exactly where SerNet comes in. It all starts with in-depth technical consulting: Which systems should be included in the scan, how should it be configured, and who will decide on the findings later? This is followed by a proof of concept in the customer’s network, which we set up together with Greenbone—the results remain within the customer’s own network, and SerNet is the primary point of contact. Greenbone has been developing vulnerability management solutions since 2008 and is the developer of OPENVAS, the world’s most widely used open-source tool of its kind. SerNet uses it in client projects and relies on it for its own infrastructure as well.
Afterward, the consulting process proceeds in cycles, as a close collaboration if desired: scanning, reviewing results together, prioritizing, defining measures, and verifying effectiveness. We provide guidance even when things get uncomfortable—whether it’s the server no one wants to touch or the risk acceptance that someone must take responsibility for. Over the years, the focus shifts: recurring findings reveal where the architecture needs to be updated. Network segmentation, firewall policies, endpoint security, and virtualization that can be patched without halting operations. SerNet plans and implements these solutions, drawing on nearly three decades of expertise and incorporating this knowledge into the optimization process for its customers.
Ultimately, there is one question on which every single decision hinges: How closed must a system be, and how open can it remain? There is no general answer—only one tailored to the specific network. A conversation with our sales team will clarify where you stand and where vulnerability management needs to begin.
The SerNet Forum takes place several times a year at Medienhaus Göttingen: a presentation on current IT topics starting at 5:00 p.m., followed by a Q&A session, and a wrap-up with time for discussion over light refreshments. Most recently, the topics were virtualization with Proxmox and Wi-Fi security.
Next event and registration: sernet.de/forum
