Why didn't I get an ARO for a very high CVE

Field Effect reports endpoints it observes with out-of-date Windows operating system (OS) builds in routinely generated AROs.

Field Effect reports these AROs 14 days after Microsoft releases the latest Windows build, which Microsoft typically does on the second Tuesday of each month ("Patch Tuesday"). This delay allows Windows updates to propagate to endpoints and accounts for our clients' different procedures, ensuring they've applied updates before we alert.

While Microsoft releases updates for Windows OS vulnerabilities on a regular schedule, each software vendor handles patches for other vulnerable software differently (and in some cases releases no patch when it announces the vulnerability). 

Although Field Effect routinely reports vulnerable software detected in your environment, our security team monitors for new CVEs affecting clients which require urgent attention and works to report these threats in a dedicated ARO as quickly as possible.

We understand that this delay may not be suitable for all clients, and we can configure this delay to your needs if you have a preferable timeline for when you would want to receive AROs for out-of-date Windows OS versions in your environment by contacting support@fieldeffect.com

Any rescheduling would be applied to every monthly Windows update, regardless of the significance of what the new OS build addresses.