The time between a zero-day vulnerability being discovered and actively exploited in the wild dropped below 48 hours throughout 2025. For a 15-person startup in BGC running Microsoft 365, an Ivanti Connect Secure VPN, and a Fortinet firewall, that means an attacker can establish persistent access before your one-person IT team even sees the advisory.
If you just graduated and chose the startup over the stable bank job because you wanted impact, you are now that one-person IT team. Here are six mistakes that turn a manageable patch window into a breach that kills your company.
What's Happening Right Now
The National Vulnerability Database and CISA's Known Exploited Vulnerabilities (KEV) catalog both show accelerating exploit development. Threat actors no longer wait for researchers to publish details — they reverse-engineer patches within hours and weaponize them. Nation-state groups (MUSTANG PANDA targeting Ivanti, KUSTIRIUM targeting Fortinet) and criminal ransomware gangs operate on the same compressed timeline. A 2026 CISA alert noted that 78% of actively exploited vulnerabilities were targeted within one week of disclosure.
For a startup with no dedicated security team, the practical reality is this: you will learn about a critical exploit at the same moment your competitor's bank does — but they have a SOC team responding while you are still reading the email.
How This Attack Works
A zero-day exploit follows a predictable chain. An attacker finds a software flaw the vendor doesn't yet know about. They build an exploit. They scan the internet for vulnerable systems — your Fortinet VPN or Ivanti gateway is sitting on a public IP with a known version number. They inject code, gain a foothold, move laterally to your email or file server, and deploy ransomware or exfiltrate data. The entire chain, from initial scan to full compromise, can complete in under four hours when the exploit is automated.
The critical window for you — between public disclosure and vendor patch — is measured in hours. Not days. Not weeks.
Real-World Examples
Ivanti Connect Secure (2024): CVE-2023-46805 and CVE-2024-21887 were chained together to achieve remote code execution. MUSTANG PANDA exploited them against government and enterprise targets. Thousands of unpatched Ivanti instances remained exposed for months because organizations had no process for emergency VPN replacement. A 20-person fintech in Singapore lost customer PII and faced BSP notification requirements.
MOVEit Transfer (2023): The Cl0p ransomware gang exploited a SQL injection zero-day in MOVEit file transfer software. Over 2,500 organizations were affected, including healthcare providers and law firms. Many were SMEs that had never heard of MOVEit's exploitability because their vendor said "we handle security."
Fortinet CVE-2022-42475: A heap buffer overflow in FortiOS allowed unauthenticated remote code execution. Multiple threat actors exploited it within weeks. Startups running Fortinet gateways without auto-updates were compromised silently — the only indicator was unusual outbound traffic to C2 servers.
Who Is Most at Risk
Companies between 10 and 200 employees using any combination of: Microsoft Exchange (on-premises), Ivanti or Fortinet VPN appliances, MOVEit or similar file transfer tools, and Chrome/Edge as their primary browser. If you are the person who registers the company with the DTI, sets up the GCash merchant account, and also configures the firewall — you are the highest-risk profile in the threat ecosystem.
Mistake #1: Waiting for an Automated Update
Your Fortinet box checks for updates nightly. The exploit was published at 06:00 UTC. You have an 18-hour exposure window. Automated patching is necessary but never sufficient for actively exploited zero-days. You need a human monitoring CISA KEV and vendor security advisories daily — even for 15 minutes.
The fix: Subscribe to CISA's KEV RSS feed and your vendors' security mailing lists. Assign one person (you) to check them every Monday and Thursday. If a KEV entry matches your stack, patch immediately regardless of the scheduled window.
Mistake #2: Assuming "We're Too Small to Target"
Automated scanning tools do not care about your revenue. They scan IP ranges for software version strings. If your Ivanti gateway is running a vulnerable firmware version, it is a target whether you process 50 transactions a month or 50,000. The 2023 MOVEit breach hit organizations with as few as 12 employees.
The fix: Run an external scan of your own public IPs using free tools like Nmap or Shodan. Check whether your VPN, firewall, and file transfer software versions appear in any known-vulnerable list.
Mistake #3: Treating Every Software Update the Same
A typo fix in a desktop app is not the same urgency as an unauthenticated RCE in your perimeter device. Startups that apply all updates during a monthly "patch Tuesday" window leave critical perimeter vulnerabilities open for weeks.
The fix: Classify your software into two tiers. Tier 1 (patch within 24 hours of a KEV match): VPN appliances, firewalls, email servers, file transfer tools. Tier 2 (patch within scheduled windows): desktop applications, internal tools, non-critical SaaS.
Mistake #4: Having No Emergency Access Plan
When Ivanti was exploited, the recommended response was to factory-reset the device and reinstall firmware. For a startup that relies on that single VPN box for remote access, a factory reset means nobody can work until you rebuild the configuration from scratch. If your configuration lives only on the device, you have no recovery path.
The fix: Export and securely store configurations for every network appliance. Test the restore process quarterly. A five-minute config backup prevents a five-hour outage during an emergency.
Mistake #5: Not Knowing What Your Network Actually Logs
Post-exploitation detection requires logs. If your Fortinet firewall logs are going to a local disk that overwrites every 48 hours, and an attacker gains access on Monday and exfiltrates data on Wednesday, you will never know. Small companies that discover breaches through ransomware notes or customer complaints — not detection — are the norm, not the exception.
The fix: Forward security logs to a centralized destination with at least 90 days retention. A free tier of Wazuh or a basic ELK stack on a cloud VM costs less than ₱2,000/month and gives you a searchable record that survives device resets.
Mistake #6: Not Knowing Who Makes the "Emergency Patch" Decision
At a startup, "patch now" means someone might need to reboot the VPN box during a client demo. If nobody has the authority to say "yes, do it now," the patch waits. In a zero-day scenario, waiting is the vulnerability.
The fix: Write a one-page incident response trigger: "If a KEV entry matches Tier 1 software, the person who sees the alert patches immediately without approval." Put it in your team's shared document. Name yourself as the responsible person.
Warning Signs to Watch For
- Unexpected reboots or configuration changes on your VPN or firewall
- New local admin accounts you did not create
- Outbound connections to unfamiliar IP addresses (check your firewall logs weekly)
- Microsoft 365 sign-in alerts from countries where you have no operations
- Email rules created automatically that forward messages to external addresses
How to Protect Your Business
Layered defense for a 10–200 person company without a security team:
- 1Reduce your attack surface. If you do not need an on-premises Exchange server, move to Microsoft 365 cloud. If you can replace your Ivanti VPN with Cloudflare Zero Trust or Tailscale (which patch automatically and expose less to the internet), do it. The best vulnerability is one you eliminate.
- 1Enable phishing-resistant MFA. Use hardware keys (YubiKey) or passkeys for admin accounts. SMS-based 2FA is vulnerable to SIM-swap attacks and does not protect against token theft.
- 1Segment your network. Your accounting workstation should not be on the same subnet as your public-facing file server. A compromised laptop should not reach your CRM without explicit routing.
- 1Back up offline and test restores. Use the 3-2-1 rule: three copies, two media types, one offsite. Ransomware that encrypts your backups while you sleep is a solved problem only if you test recovery quarterly.
- 1Follow the CIS Controls benchmark (specifically Controls 1–14) as your security roadmap. It is free, it is practical, and it is designed for exactly your size.
Quick Action Checklist
- [ ] Subscribe to CISA KEV alerts and set up RSS notifications (15 minutes, today)
- [ ] Inventory every internet-facing device and note its exact firmware version (1 hour)
- [ ] Cross-reference versions against KEV catalog; patch Tier 1 matches immediately
- [ ] Export and store configurations for all network appliances in an encrypted vault
- [ ] Enable logging with 90-day retention on your firewall and VPN
- [ ] Deploy phishing-resistant MFA on all admin accounts (hardware keys or passkeys)
- [ ] Write and publish a one-page emergency patch authority document
- [ ] Schedule a quarterly backup restore test with the whole team present
Start Here This Week
You chose the startup because you wanted to build something. That only works if the thing survives. Spend Thursday afternoon doing the inventory and KEV cross-reference. It is the single highest-impact security action a new employee can take on day one, and it will outlast every tool you deploy later.
Frequently Asked Questions
How quickly should a small company patch a zero-day vulnerability?
For vulnerabilities listed in CISA's KEV catalog that match software you use, patch within 24 hours — treat it as an emergency reboot, not a scheduled maintenance window. For all other critical vulnerabilities, patch within 72 hours. Automated updates alone are not sufficient because they often delay deployment for stability testing.
Is my 15-person startup really a target for nation-state attackers?
You are not targeted because of who you are. You are targeted because your exposed software versions match a list that automated scanning tools check continuously. Nation-state groups scan entire internet ranges indiscriminately. If your Ivanti gateway is running a vulnerable version, it is on the list whether you know it or not.
What should I do if I discover I was already compromised?
Disconnect the affected device from the network immediately (unplug the cable or disable Wi-Fi — do not shut down, as volatile memory may contain forensic evidence). Report to the NPC under the Data Privacy Act if personal data was involved. Contact CISA and consider filing with the NBI Cybercrime Division. Do not attempt to clean the system yourself before preserving logs, because you will destroy the evidence that tells you how they got in and what else they touched.