Updates and Drivers: The New Entry Points That Cybercriminals Are Exploiting in Information Systems

Keeping systems up to date remains one of the most important rules of cybersecurity. However, the mechanisms designed to fix vulnerabilities can themselves be exploited. Fake patches, compromised distribution channels, legitimate but vulnerable drivers: cybercriminals now exploit components that systems trust implicitly. For CIOs, patch management must therefore incorporate more controls without slowing down the process of fixing vulnerabilities. 

When Updates Themselves Become Vectors for Cyberattacks

Attacks against the softwaresupply chain exploit precisely this relationship of trust. By compromising a software vendor, a service provider, or a distribution infrastructure, attackers may seek to inject malicious code into software or an update. The file is then likely to be distributed through a channel that the company normally considers legitimate.

Other attacks rely on more direct methods. A fake security advisory, a page mimicking a vendor’s website, or a purported update tool can trick a user into installing malware.

However, the trust placed in a software component has another limitation: even if it is authentic and properly signed, it may contain an exploitable vulnerability.

Vulnerable Drivers: An Often-Underestimated Threat

Drivers facilitate communication between the operating system and hardware components. Some have elevated privileges, extending all the way to the Windows kernel: a flaw could then allow an attacker to bypass the system’s security protections.

This is the principle behind “Bring Your Own Vulnerable Driver” (BYOVD) attacks. Rather than developing a malicious driver that risks being blocked, the attacker introduces or uses a legitimate driver containing a known vulnerability. This type of attack illustrates the risks associated with software components to which the system grants elevated privileges. It also underscores the importance of a risk assessment covering the entire information system—as exemplified by the approach advocated by Fidens by TVH Consulting through its audit, risk analysis, and security governance services.

In August 2025, CERT Santé documented this technique in the operations of the Qilin ransomware group. In particular, the attackers used TPwSav.sys, a signed and vulnerable Toshiba driver, to intervene at the Windows kernel level and bypass security protections.

The proliferation of attack surfaces and cybercriminal groups complicates risk management

Drivers are only part of the problem. A single workstation hosts an operating system, business applications, security software, device drivers, and firmware. Each has its own maintenance cycle and may be subject to specific vulnerabilities.

Attackers exploit these differences, as well as the lack of visibility into installed components. A known vulnerability in an outdated driver may still exist on a few machines even after the majority of the fleet has been updated.

This complexity is compounded by increasingly organized cybercrime. “Cybercriminal groups are now structured like real businesses, with tools, processes, and specializations,”explains Laurent Galvani, a cybersecurity expert at Fidens by TVH Consulting.

The Ransomware-as-a-Service (RaaS) model illustrates this organization: some actors develop or maintain the tools, while others handle the intrusions and exploit them.

For businesses, the challenge is therefore to have a precise understanding of the components present on their systems, their versions, their dependencies, and the vulnerabilities to which they are exposed. Without a reliable inventory, patch management will inevitably remain incomplete.

Rethinking patch management: moving beyond simple updates to continuous monitoring

Applying a patch as soon as it becomes available may seem like the best protection. In practice, update management requires balancing risk reduction with business continuity.

A faulty network driver can render a workstation inaccessible. A new firmware version can alter a device’s behavior. Conversely, delaying a critical patch for too long leaves a vulnerability open to exploitation.

Before any deployment, the origin and integrity of the files must be verified using the mechanisms provided by the vendors. The most sensitive patches can then be tested on a representative subset of the environment to identify any potential incompatibilities.

A phased deployment helps limit the consequences of an incident: a few pilot machines, then a larger group, before rolling out to the entire system. This approach also requires planning for rollback procedures in case a change causes a malfunction.

Automation helps make these operations reproducible while maintaining control points. The importance of infrastructure monitoring, deviation verification, and patch automation is also discussed in an analysis available on Le Monde Informatique.

Automation and Monitoring: Toward Proactive Vulnerability Management

Effective monitoring integrates component inventory, vulnerability monitoring, and patch deployment.

An up-to-date inventory makes it possible to identify the versions installed on devices. Information published by software vendors and cybersecurity organizations can then be cross-referenced with this inventory to identify machines affected by a vulnerability.

This visibility facilitates prioritization. A flaw being actively exploited on a server exposed to the Internet generally requires a faster response than a vulnerability of the same theoretical severity affecting an isolated and unused component.

Tools for monitoring and managing the IT infrastructure can automate part of the work: detecting obsolete versions, tracking deployments, reporting errors, and generating compliance reports. This has been a top priority for IT departments for several years, as the website Cloudlist.fr regularly points out. But initiating an update does not mean it has been installed. A powered-off device, a delayed reboot, or a silent failure can leave the vulnerability unresolved. Monitoring must therefore focus on the actual status of the equipment after the update.

For critical drivers, this monitoring can be supplemented by mechanisms to control applications and block vulnerable drivers, while taking into account their potential impact on hardware compatibility.

Making Patch Management a True Cornerstone of Cybersecurity Governance

Effective update management relies on more than just tools. It requires a common policy among operations teams, security managers, and business units. This policy must specify, in particular, expected remediation timelines based on criticality, validation procedures, responsibilities, and the conditions under which an update may be deferred. When a patch cannot be applied immediately, mitigating measures must be evaluated and the residual risk documented.

The NIST (National Institute of Standards and Technology) also classifies patch management as part of a preventive maintenance process, encompassing the identification, prioritization, installation, and verification of patches. This approach involves technical managers as well as business units when operations may affect service availability.

Several metrics can be used to track results: the percentage of up-to-date devices, the number of unpatched critical vulnerabilities, the average remediation time, deployment failures, and exceptions awaiting resolution.

Updates remain essential to the security of information systems. However, attacks that exploit the trust placed in drivers and distribution mechanisms serve as a reminder that these processes must be properly managed. Risk management now depends on the ability to identify vulnerable components, deploy appropriate fixes, and continuously verify their effectiveness.