Which factors are currently impeding your efforts to patch the Log4j vulnerability? (Select all that apply.)

Difficulty determining the extent of our exposure28%

Difficulty determining if third-party vendors have been affected42%

Third-party vendors who are unable or unwilling to patch Log4j35%

Lack of support32%

Lack of patch management controls20%

New versions that contain breaking changes18%

Affected software is no longer maintained18%

Insufficient human resources14%

Current update processes slow down remediation9%

Transitive dependencies are unclear9%

Software inventory is not updated11%

Patching Log4j has been deprioritized6%

Patching requires too much downtime5%

Other (Please share below!)3%

We provide company-wide training57%

We only train certain departments/roles32%

We have a targeted individual training approach.9%

I am unsure how we handle security training.3%

Yes, and we actively scan for these types of vulnerabilities.24%

Yes, but we're still working out our strategy for these attacks.59%

No, we're not concerned about zero-click attacks.15%

Other (please share below)0%