Reduce the Attack Surface First, Then Patch. Why That Order Matters.

Reduce the attack surface first, then patch. That is how Kane Nawrocki sequences the work at inSUPPORT, and it is his own operating order. It is not an instruction from the Australian government, and the difference matters if a framework deadline has just landed on your desk. The Australian Signals Directorate does publish a suggested implementation order, and it is organised differently.

Somebody has told you to patch everything and handed you a list you cannot finish this month, so the order is not academic. You have a fixed number of hours and nobody in-house to spend them. Get the order wrong and the hours go on the wrong things.

What ASD sequences on is exposure. Its patch clock is set by how reachable a thing is, not by how important it feels from the inside. That supports most of what the order above is reaching for, by a different route. The route is the useful part. Exposure is also the thing a client or an insurer can check from the outside.

ASD itself puts reduction first in two defined cases. Where no patch exists, it names disabling the vulnerable functionality or blocking access to the service. Where a vendor mitigation arrives ahead of the patch, the patch follows it.

TL;DR: Whose order this is, and what ASD publishes

• ✅ Reduce the attack surface, then patch, is Kane Nawrocki's own operating order.
• ✅ ASD does publish a suggested order. It runs by threat first, then down an effectiveness rating. Patching sits in the same essential tier as application control and user application hardening.
• ✅ ASD's patch clock is set by exposure. Internet-facing services get 48 hours when a vulnerability is critical. Workstations get a month.
• ✅ Where no patch exists, ASD names disabling the vulnerable functionality or blocking access to the service.
• ✅ Every service you take off the internet is a line off the 48-hour list.

Contents

• Where the Order Comes From, and Where It Does Not
• What ASD Actually Sequences On, Which Is Exposure
• Where Reduction Is Actually the Published Answer
• What businesses with a deadline ask about order

Where the Order Comes From, and Where It Does Not

Reducing the attack surface before patching is how Kane sequences the work. What you can put in front of a board is what ASD publishes, so start there.

ASD publishes a suggested implementation order in Strategies to mitigate cyber security incidents, first published in 2010 and last reviewed in June 2026. It tells you to start with the threats of most concern to your organisation. Then it works down an effectiveness rating: implement the essential strategies, repeat with the excellent ones, then repeat with the less effective ones until residual risk is acceptable. For ransomware it puts recovering data and system availability first. Nothing in it sets out reduce-the-surface-then-patch as a sequence.

Look at the essential tier and the reason becomes clear. To prevent malware delivery and execution, ASD rates four strategies essential: application control, patch applications, Microsoft Office macro settings, and user application hardening. Three of the four shrink the attack surface. ASD treats them as one tier of work rather than a queue. ASD also warns that no set of mitigation strategies is guaranteed to prevent all cyber security incidents, which is worth putting next to any sequence.

What ASD Actually Sequences On, Which Is Exposure

ASD's own sequencing instinct turns up in its patching guidance, and it is exposure. Its position is that once a vendor releases a patch, it should be applied in a timeframe commensurate with the organisation's exposure to the vulnerability. The reason is timing, and once a vulnerability in an online service is made public, ASD says malicious code can be expected within 48 hours. Sometimes it is within 24. So the clock starts when the vulnerability becomes public, not when you get to it.

That produces a published order, and it reads as a list of what is reachable. Online services come first, inside 48 hours where a vulnerability is critical or a working exploit exists, and within two weeks otherwise. Then the operating systems of internet-facing network devices and internet-facing servers, on the same clock. Then commonly targeted applications, within two weeks. Then non-internet-facing devices, servers and workstations, within a month. Drivers and equipment firmware sit at the end of the list, and ASD scopes those to high-threat environments.

There is a line in there for anyone short of hands. Where resources are constrained, ASD says patches should first be applied to internet-facing infrastructure. Its guidance on implementing any mitigation strategy says the same thing differently. Start with the high-risk users and computers, including those exposed to untrustworthy internet content. Then do everyone else. Read the two together and they are consistent with the order at the top of this page.

Where Reduction Is Actually the Published Answer

ASD does prescribe surface reduction, in two defined places. The first is when there is no patch. Its guidance is that temporary workarounds may be the only effective protection, and it names two: disabling the vulnerable functionality, or restricting or blocking access to the vulnerable service.

The second is the closest ASD comes to this order. It notes that vendor mitigations which are not patches sometimes arrive before a patch, or alongside a disruptive one. Where the mitigation comes first, ASD says the patch should follow. Reduce, then patch, for that case rather than as a rule.

The Essential Eight carries reduction inside the patch strategies. At Maturity Level One, unsupported online services are removed and unsupported operating systems replaced. Removal is not patching. It is what you do so there is nothing left to patch. How it gets measured is covered in an Essential 8 assessment, and the evidence to sight at a review is its own list.

This article reflects ASD guidance as published at October 2026. ASD consulted on evolving the Essential Eight from 15 June to 12 July 2026 and published the result as the ASD Essentials on 15 October 2026, so check the current version. A first pass is short, and a documented look at the environment is where it gets recorded:

• List what is reachable from the internet.
• Remove what nobody needs, and what no vendor supports.
• Patch what is still exposed, in ASD's published order.
• Record the dates and the scope. That is what an assessor sights.

What businesses with a deadline ask about order

Is reduce-then-patch a government requirement?

No. It is how Kane Nawrocki sequences the work. None of the three ASD publications that would carry such an instruction sets out reducing the attack surface before patching as a sequence: Strategies to mitigate cyber security incidents (last reviewed June 2026), Patching applications and operating systems (last reviewed November 2023), and the Essential Eight maturity model (last reviewed November 2023). What ASD does publish is a suggested order by threat and by effectiveness rating. It also publishes a patch order driven by exposure, and surface reduction as the answer where no patch exists. Provenance is not pedantry here, because a board told that something is a government requirement will ask to see it. If a requirement document in front of you cites a specific government instruction, read that document, because it is the thing you have to satisfy. Do not accept a provider's sequence as a compliance obligation without seeing where it is written.

We have no one in-house. Does the order change what we should ask a provider for?

Yes, and it makes the ask easier to check. Ask for the list of what is reachable from the internet, and ask when it was last compiled rather than when it was last discussed. Ask which of those services and devices are still supported by their vendor, because the unsupported ones are a removal decision rather than a patching one. Then ask for the patch position against ASD's own timeframes, exposed infrastructure first. None of that needs you to be technical, because every answer is a list with dates on it. ASIC's 2023 cyber pulse survey (Report 776) found 20 per cent of participants had not adopted a cyber security standard. Then ask who owns each list, and when it is next refreshed.

How fast does ASD expect a patch to be applied?

It depends on exposure, which is the whole point of the order. Online services and the operating systems of internet-facing servers and network devices get 48 hours where a vendor assesses the vulnerability as critical or a working exploit exists. Two weeks otherwise. Commonly targeted applications are within two weeks. Non-internet-facing devices, servers and workstations are within a month. ASD also expects vulnerabilities to be addressed during a change freeze, especially within 48 hours for internet-facing infrastructure, which is worth knowing before December arrives. Scanning has its own cadence, daily for internet-facing infrastructure and at least fortnightly for workstations. The scanning cadence matters as much as the patching one, because you cannot patch what nothing has found.

Where do we start if nobody has mapped what is exposed?

With the map, because every other decision depends on it. A Cyber Strength Audit documents the environment against the compliance frameworks that apply to your industry and the technical controls insurers expect to see, including identity and access, patching currency, backup and recovery, email and endpoint, and configuration drift. The output names what is reachable, what has quietly fallen behind, and what it takes to close each gap, ranked by business impact rather than by how badly it scores. From there the order argument becomes concrete. You are sequencing a real list instead of a general principle. Ask for it as a document rather than a conversation. That is also the document an assessor, or a client asking for proof, will want to see.

Sources

• "Strategies to mitigate cyber security incidents", Australian Signals Directorate. Published 18 February 2010, last reviewed 17 June 2026. The source for the suggested mitigation strategy implementation order (start with the threats of most concern, then work down the effectiveness ratings from essential to excellent to less effective, with recovery of data and system availability first for ransomware), for the four strategies rated essential to prevent malware delivery and execution being application control, patch applications, Microsoft Office macro settings and user application hardening, and for the instruction to implement a mitigation strategy first for high-risk users and computers including those exposed to untrustworthy internet content. Read in full on cyber.gov.au, 20 October 2026. It contains no instruction to reduce the attack surface before patching. cyber.gov.au
• "Patching applications and operating systems", Australian Signals Directorate. Published 1 October 2011, last reviewed 27 November 2023. The source for applying a patch in a timeframe commensurate with the organisation's exposure to the vulnerability, for malicious code being expected within 48 hours and sometimes 24 of a vulnerability in an online service becoming public, for the prioritised patch and scanning timeframes, for prioritising internet-facing infrastructure where resources are constrained, for addressing vulnerabilities during change freeze periods, for temporary workarounds being the only effective protection where no patch exists (disabling the vulnerable functionality, or restricting or blocking access to the vulnerable service), and for vendor mitigations sometimes arriving before a patch with the patch applied as a follow-up. cyber.gov.au
• "Essential Eight maturity model", Australian Signals Directorate. Published 30 June 2017, last reviewed 27 November 2023. The source for the Maturity Level One requirements that online services no longer supported by vendors are removed and unsupported operating systems are replaced, and for the model's own sequencing rule, which is to reach the same maturity level across all eight mitigation strategies before moving to a higher one. cyber.gov.au
• "Frequently asked questions", Australian Signals Directorate, the ASD Essentials FAQ. Published and last reviewed 15 October 2026. The source for the consultation on evolving the Essential Eight running from 15 June to 12 July 2026, and for its result being published as the ASD Essentials. Read 20 October 2026. cyber.gov.au
• "23-300MR ASIC calls for greater organisational vigilance to combat cyber threats", Australian Securities and Investments Commission, 2023 media release on ASIC's cyber pulse survey (Report 776). The source for the survey finding that 20 per cent of participants had not adopted a cyber security standard. asic.gov.au

Related Reading

• What Does an Essential 8 Assessment Actually Involve?
• What Your Provider Should Show You at an Essential 8 Review
• Essential 8 Maturity Level 1, 2 or 3: Which Do You Need?
• Cyber Strength Audit

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.