A company decides to remediate issues identified from a third-party penetration test done to its infrastructure. Management should instruct the IT team to:

Applying hot fixes immediately to all vulnerabilities without evaluation risks system instability from untested patches and wastes resources on low-risk findings that may not require emergency remediation.

Executing hot fixes to only some vulnerabilities without a formal evaluation process is arbitrary and fails to ensure the most critical risks are addressed with appropriate urgency.

Deferring all remediation to quarterly patching cycles may leave critical or actively exploited vulnerabilities exposed for an unacceptably long period, increasing organizational risk.

A risk-based evaluation process assesses each vulnerability's severity, exploitability, and business impact before assigning remediation priority. Critical vulnerabilities may require immediate action while lower-severity findings can be addressed in scheduled maintenance windows. This approach - aligned with frameworks such as NIST SP 800-40 - balances security urgency with operational stability and ensures resources are applied where risk is highest.