Security agencies publish a steady stream of alerts. Knowing which ones apply to you is a practical skill.

Where advisories come from

– Canadian Centre for Cyber Security: alerts, advisories, and guidance for Canadian organizations

– U.S. CISA and the FBI: joint advisories and emergency notices, including a list of vulnerabilities known to be exploited in the wild

– Vendors: Microsoft, firewall makers, and others publish security bulletins

– Industry groups and information-sharing communities

Types of advisories

– Vulnerability alerts: a flaw in software you may use

– Active exploitation warnings: attackers are already using the flaw

– Threat actor reports: how a criminal group operates, with indicators to look for

– Guidance: recommended configurations or best practices

What deserves immediate action

– A vulnerability in internet-facing systems (firewalls, VPNs, remote access, email servers) that is actively exploited

– An advisory that names software or devices you run

– Warnings about credentials or tokens that may have been stolen from a vendor you use. For example, a July 2026 FBI advisory warned that credentials harvested in supply chain campaigns could be used long after the original compromise.

A simple triage process

1. Know what you run: maintain an up-to-date inventory

2. Subscribe to alerts from your national cyber centre and key vendors

3. Assess: Does it affect us? Is it exploited? Is it internet-facing?

4. Prioritize: actively exploited and internet-facing come first, with deadlines measured in days

5. Mitigate: patch, apply workarounds, or isolate

6. Verify and document

7. Check for compromise if exploitation was possible before you patched

Let someone own it

Assign responsibility inside your organization or to your managed service provider, and review at a set cadence.

Don’t ignore the “boring” advice

Many advisories repeat the same fundamentals: MFA, patching, backups, and least privilege.

DBR Soft’s managed services monitor advisories and act on those that affect you. Contact us for more information.