It happens a few times a year. A vulnerability in a VPN appliance, a firewall, a file-transfer tool or a widely used library gets announced, it's rated critical, and within hours there are reports of attacks. Clients start emailing. Your team wants to know where to start.

The MSPs that handle these well aren't faster typists. They follow the same short routine every time.

Hour 0 to 4: confirm what you're dealing with

Before touching anything, answer four questions from reliable sources (the vendor advisory, the CVE record, and CISA if it has commented):

What exactly is affected? Product, versions and configurations. Many critical flaws only apply when a specific feature is turned on.

Is it being exploited? Check whether it's on CISA's Known Exploited Vulnerabilities catalog, and look at its EPSS score, which estimates how likely exploitation is in the next 30 days.

Is it reachable from the internet?…