A post-breach forensic investigation revealed that a known vulnerability in Apache Struts was to blame for the Equifax data breach that affected 143 million customers. A fix was available from the sof

Vendor risk management addresses risks introduced by third-party suppliers and their products, not the internal failure to deploy an already-available software patch.

Security awareness training targets human behavior such as phishing susceptibility, not operational processes for maintaining system software currency.

Secure deployment lifecycle (SDLC) governs how in-house software is designed, built, and released, not how externally supplied patches are applied to production systems.

Patch management is the operational process of identifying known vulnerabilities, obtaining vendor-supplied fixes, and applying them to systems in a timely manner. Because a fix had been available for months before the intrusion, the failure to apply that patch is the root cause of the breach and is the direct responsibility of the patch management process.