Managing Security Tools as Core Technology Assets Throughout Their Lifecycle

Kaspersky Endpoint Security for Windows (KES) is an endpoint security product designed to protect Windows devices against malware, ransomware, and other security threats. It is currently used by more than 200,000 organizations worldwide. In early September 2026, CERT-FR — France’s national cybersecurity incident response team operated by ANSSI — issued an advisory concerning Windows versions 14.0 and 14.1 that had not received the 30 August 2026 update. The vulnerability could allow established security policies to be bypassed. In practice, this meant that certain protection rules configured on affected endpoints might no longer operate as intended, increasing the risk that abnormal activity could pass through without being blocked in time.

The case highlights a broader operational reality: deploying a security product does not mean the associated risk has been permanently addressed. Vulnerabilities can emerge, software versions can become outdated, and changes introduced during day-to-day operations can affect how effectively a security control performs. Security tools therefore need to be managed as ongoing technology assets rather than` one-time investments. Version status, patches, configurations, and emerging vulnerabilities all require continuous attention so that changes affecting the organization’s security posture can be identified and addressed before the exposure becomes more difficult to contain.

Security Tools Can Become an Attack Surface Themselves

The Kaspersky case is one example of a wider trend: attackers increasingly exploit vulnerabilities in technologies that enterprises already rely on as part of their day-to-day infrastructure. According to the Verizon DBIR 2026, exploitation of vulnerabilities accounted for 31% of the data breaches analyzed, overtaking stolen credentials for the first time as one of the most common initial access vectors. The Google Threat Intelligence Group’s 2026 analysis also found that almost half of the newly exploited vulnerabilities observed in 2025 affected enterprise technologies, including a notable number of security and networking products. ENISA reporting has similarly documented exploited vulnerabilities affecting technologies positioned directly within the security and connectivity stack, including Citrix NetScaler and VPN products from Fortinet, Check Point and Palo Alto. The implication is important: security technologies are not inherently outside the organization’s risk surface. When a protective layer contains an exploitable vulnerability, becomes unstable or no longer behaves as designed, the consequences may extend beyond the affected product itself. Monitoring coverage, threat detection, and the resilience of connected systems can all be affected.

From Security-Tool Vulnerabilities to Operational Risk

Cyber incidents do not follow a single predictable sequence. A more common management gap arises when an organization invests in security technologies and then assumes those controls will continue to operate effectively without the same level of attention given to other critical technology assets. That assumption can create exposure over time. If a vulnerability in a security product is successfully exploited, the impact will depend on the nature of the weakness. In some cases, an attacker may be able to bypass existing controls, expand access, or weaken the organization’s ability to monitor and detect suspicious activity.

At that point, the issue is no longer limited to the vulnerable security tool. Suspicious activity may go undetected for longer. Compromised access could be used to reach additional accounts or systems. Meanwhile, operational teams may need to devote considerably more time and specialist resources to determine the scope of the incident, isolating affected systems, and restoring them to a secure state. If the incident reaches business-critical systems, the consequences may include operational downtime, longer recovery cycles, higher remediation costs, and increased exposure of business data. This is why cybersecurity capability cannot depend on technology alone. It needs an operating model in which People, Process and Technology work together and evolves continuously as the risk environment changes.

NetGuardX Strengthens Cybersecurity Across Three Core Pillars

NetGuardX is a cybersecurity service developed by NetNam specialists to strengthen enterprise capabilities across monitoring, detection and response. Building on more than 32 years of experience in IT and collaboration with international technology providers, NetGuardX operates around three interconnected pillars — People, Process and Technology. This brings specialist expertise, response processes, and security technologies together within a continuous monitoring model.

NetGuardX is designed to work alongside the enterprise rather than simply step in after an incident has occurred.

By coordinating with internal teams, NetGuardX supports organizations in progressively strengthening cybersecurity capabilities around their existing systems, available resources and actual operational requirements.

The objective is to establish a security capability that remains effective as both the technology environment and the organization’s risk profile continue to change.

Learn more about NetGuardX services!

Hotline: 1900 1586

Email: marketing@netnam.vn

Website: https://netnam.com/netguardx

NETNAM CORPORATION – 30 years of trusted internet & managed IT solutions and services for businesses

Head Office: 2nd Floor, HITC Building, 239 Xuan Thuy Street, Cau Giay Ward, Hanoi

Branch Office: 7 Nguyen Thi Minh Khai Street, Sai Gon Ward, Ho Chi Minh City

Representative Office: 2 Quang Trung Street, Hai Chau Ward, Da Nang

Reference:

https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1101/

https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review?hl=en