A security administrator is reviewing patch management practices and finds that critical patches are taking an average of 45 days to deploy after release. A threat actor is known to exploit new vulnerabilities within 7 days of patch release. What risk does this gap create and what is the appropriate control?

The correct answer is the 38-day window where systems are vulnerable to known, patchable exploits; the control is to reduce the critical patch SLA to under 7 days and prioritize internet-facing and critical systems first. Attackers exploit vulnerabilities within 7 days while patches take 45 days, leaving a 38-day exploitation window for known vulnerabilities; reducing the critical patch SLA and prioritizing highest-risk systems directly closes this gap. The option claiming no risk exists because attackers rarely target patched vulnerabilities is wrong because attackers specifically target recently patched vulnerabilities, since many organizations patch slowly, making this window highly targeted. The option saying the 45-day patch cycle is standard industry practice and poses minimal risk is wrong because a 45-day cycle for critical patches is too slow given current threat actor exploitation timelines; industry best practice is 7-30 days for critical. The option proposing to disable vulnerability disclosure is wrong because disabling vulnerability disclosure is impractical, unethical, and would harm the security community's ability to coordinate defenses.