Risk Mitigation for Unpatched Legacy Systems

Quick Answer

Risk mitigation is the correct classification here because the organization isn't eliminating the risk, transferring it to someone else, or simply accepting it; it's actively reducing the likelihood and impact of exploitation through added controls, which is the textbook definition of mitigation. Strict network segmentation limits what an attacker could reach even if they successfully exploited the vulnerability, shrinking the potential blast radius, while continuous monitoring increases the odds that an exploitation attempt is detected quickly, shortening the window of undetected compromise. Neither control removes the underlying flaw itself, the CVE with a CVSS score of 9.8 is still present and unpatched, which is exactly why this isn't risk avoidance, which would mean removing the system or the function entirely, or risk acceptance, which would mean doing nothing extra and living with the exposure as-is. It's also not risk transfer, since no third party like an insurer or vendor is absorbing the consequence. This distinction matters because these four standard risk response categories, avoid, mitigate, transfer, and accept, are commonly tested by describing a specific action and asking which category it falls into. Whenever a scenario describes adding compensating controls, such as segmentation, monitoring, or hardening, around a risk that still technically exists, that's mitigation.