In this episode of "Full Tech Ahead," host Amanda Razani interviews Thomas Scheffler, Security Manager at Cintas. Scheffler shares a real-world enterprise case study on overhauling vulnerability and patch management across Cintas’s massive infrastructure, which includes over 23,000 end-user devices and numerous corporate acquisitions.
Facing disorganized patching habits and resistance from server, desktop, and production teams, Scheffler leveraged direct backing from his CIO and CISO to shift corporate culture—getting the business to work around patching rather than making patching work around the business. Within 60 to 90 days, Cintas enforced a strict new 24-hour SLA for critical vulnerabilities.
To handle legacy applications (such as older Java environments) that broke during updates, Cintas introduced a Risk Acceptance Form (RAF) requiring application owners to seek CIO and CISO signatures alongside a mandatory remediation timeline.
Today, with AI shrinking the "click-to-compromise" phishing window from 21 minutes down to just 7 minutes, Cintas is rolling out Qualys TruRisk Eliminate to execute patchless mitigations and protect its ecosystem of over one million customers.
Key Quotes
- "My goal was to get the business to work around patching instead of patching work around the business. So in order to do that, I had to get support from the leadership team."
- "Our CISO set a goal of patching all critical patches within twenty-four hours, and everybody's chins dropped. And he just said, 'Get used to it. That's the new SLA for critical vulnerabilities.'"
- "We introduced the RAF, the Risk Acceptance Form. So the owner of that particular application had to sign that and ask the CIO and the CISO to sign it. And the odds of the CIO signing it without some sort of timeline tied to it were near zero."
- "Threat actors are now with it—from click to compromise, I think it's seven minutes, where it used to be twenty-one. So AI has reduced that window significantly."
Takeaways
- Enforce Change Through C-Suite Backing: Breaking years of ingrained IT habits requires uncompromising executive sponsorship. By having the CIO and CISO sit directly in initial stakeholder meetings and mandate a 24-hour SLA for critical patches, Cintas transformed fierce internal pushback into routine "business as usual" within 90 days.
- Eliminate Legacy Stalling with Risk Acceptance Forms (RAF): Production teams often resist security patches because updates break fragile legacy code like older Java builds. Implementing a formal RAF forces application owners to either modernize their software or formally ask the CIO/CISO to sign off on the unpatched risk—creating immediate accountability and biweekly modernization tracking.
- Defend Against the 7-Minute Compromise Window: Generative AI has eliminated obvious grammatical errors in phishing emails and accelerated the "click-to-compromise" timeline from 21 minutes to 7 minutes. Organizations must combine rapid vulnerability patching with proactive URL stripping and supplier-risk monitoring to defend against attacks originating from compromised third-party customers.
- Go Beyond Patching with TruRisk Mitigations: When a traditional vendor patch is unavailable or risks breaking production, security teams cannot simply leave the asset exposed. Utilizing mitigation platforms (like Qualys Eliminate) allows teams to neutralize threats by closing ports, altering code paths, and prioritizing internet-facing exploitability over raw risk scores.
Find Amanda Razani on LinkedIn. https://www.linkedin.com/in/amanda-razani-990a7233/
Follow the FTA LinkedIn Page: https://www.linkedin.com/company/full-tech-ahead/
Visit the FTA website: https://fulltechahead.com/
Check out the Substack Channel: https://fulltechahead.substack.com/
