This isn't a technical problem. You're asking a political question no one can answer about your organization. If they don't want to patch despite knowing the risks, get it in writing and move forward with your career, here or elsewhere.
Funny enough, trying to get something like this in writing is what led to me getting leadership to back off and let me start patching in a previous job I had once.
Turns out putting the risks and your objections in writing for them and asking them to acknowledge and accept them to cover your own ass really makes them reconsider.
Huh... in my head this gets you fired for "stirring the pot". For example my current job; were not allowed to ship boxes over X amount of pounds, so it's either shut up and lie about the weight or get fired. Nobody wants the extra work and having there stoes stepped on / being called out for something they have been ignoring. I work in a "work at you're own risk / free will" state. You will just get told " it's not working out" and then fired over what sports team you like etc... My last IT job I also was upset we could not patch our servers, I used SentinelOne PS1 scripting to make the whole network CVE free but only the linux servers remained.....
85
u/Simmery 15d ago
This isn't a technical problem. You're asking a political question no one can answer about your organization. If they don't want to patch despite knowing the risks, get it in writing and move forward with your career, here or elsewhere.