A post-breach forensic investigation revealed that a known vulnerability in Apache Struts was to blame for the Equifax data breach that affected 143 million customers. A fix was available from the sof

Secure development lifecycle (SDL) refers to integrating security practices into the software development process; since Apache Struts is a third-party framework and the fix was already provided by the vendor, the failure was not in developing secure code but in applying the available fix.

Security awareness training addresses human-factor risks such as phishing and social engineering, not the operational process of applying vendor-released vulnerability patches to production systems.

Vendor risk management focuses on assessing and monitoring the security posture of third-party vendors and suppliers; while Apache Struts is a third-party component, the core failure was the organization's internal process of not deploying the patch the vendor had already released.

Patch management is the process of identifying, acquiring, testing, and applying software updates to remediate known vulnerabilities. Because a vendor-supplied fix was available for several months before the breach occurred and was not applied, this represents a direct failure of the patch management program to track, prioritize, and deploy critical security patches in a timely fashion.