Defending against nation state-sponsored activity certainly seems like a tall order for most organizations. “Keep your patching activities a priority and current,” is well known advice, but practitioners know it is a complex challenge which is why opportunities exist for bad actors. So, where would one start with such a challenging task? How can you know which are the highest risk vulnerabilities to your organization that should be prioritized and acted on?