The Mistake: After completing Lab 1 and discovering 15 vulnerabilities, a security team documents findings in a report, files it, and considers the lab “complete.” Six months later, the same vulnerabilities remain unpatched.
Why This Happens:
- Lab activities feel like training exercises, not real security work
- Findings aren’t integrated into remediation workflows
- No accountability for fixing discovered issues
- Labs are done “for compliance” rather than to improve security
Real-World Consequence:
Case Study: A smart building operator completed Lab 1 on 200 HVAC controllers, discovering: - 180 devices with default password “admin:admin” - 150 devices with HTTP-only management (no HTTPS) - 120 devices with firmware 3+ years out of date
Lab report was filed. No remediation occurred.
8 months later: Ransomware outbreak (unrelated initial infection) spread from corporate network to HVAC controllers via default credentials. Attackers shut down HVAC to all 50 floors, demanding $500K ransom. Building evacuation required. Total cost: $2.1M (downtime + remediation + ransom payment).
Post-Incident Analysis: Every vulnerability exploited by the ransomware was documented in the Lab 1 report 8 months earlier.
The Fix: Integrate Labs into Security Lifecycle
1. Treat Lab Findings as Incident Tickets Every vulnerability discovered in Lab 1 becomes a Jira ticket with: - Severity (Critical/High/Medium/Low based on DREAD score) - Owner (assigned to IT/OT team responsible for the device) - Due date (30/60/90 days based on severity) - Acceptance criteria (how to verify fix)
2. Link Labs to Remediation Budget
- Lab 1 audit cost: 8 hours ($800 labor)
- Remediation cost: 40 hours ($4,000 labor) + password management system ($2,000)
- Total security investment: $6,800
- Risk reduction: 150 critical vulnerabilities → 5 residual
- Breach avoidance: $2.1M (ransomware case study above)
- ROI: 309x return on security investment
3. Schedule Follow-Up Labs After remediation, re-run Lab 1 to verify fixes: - Initial audit: 150 vulnerabilities found - Remediation: 145 fixes claimed by IT team - Verification audit: 15 vulnerabilities still present (incorrect fixes) - Second remediation: 10 additional fixes - Final audit: 5 accepted residual risks (documented)
4. Integrate Lab Results into Risk Register
| Default credentials |
9.2 (CRITICAL) |
2.1 (LOW) |
2.1 |
CISO |
| HTTP-only management |
7.8 (HIGH) |
3.5 (LOW) |
3.5 |
IT Director |
| Outdated firmware |
8.5 (CRITICAL) |
4.2 (MEDIUM) |
4.2 |
CTO (5 legacy devices) |
Key Takeaway: Security labs discover vulnerabilities. Security organizations FIX vulnerabilities. Without remediation, lab work is waste. Track lab findings through to resolution with the same rigor as production incidents.