Your clients' monthly security note, written and ready to send
I run EVULNABLE. Each month after Patch Tuesday I send you a plain-English note you can forward to your clients, plus a short list of what your team should patch first. I check every issue before you get it.
Each issue arrives by the Thursday after Patch Tuesday. Preview the October 2026 sample (PDF)
What it does for you
Your clients hear about a Windows flaw or a hacked VPN somewhere and wonder whether it affects them. A short note from you, sent before they ask, tells them what happened, whether it's likely to touch a business like theirs, what you're doing about it and the one thing their staff should do. That reads as an IT provider who is paying attention.
Writing that note every month takes time most MSPs don't have. I write it, so you can read it, add what you actually did and send it.
Your team gets a separate, short list of what to patch first, so the client note and the technical work stay in step.
See the October 2026 sample
This is the October 2026 sample, written for October 2026 Patch Tuesday. {MSP name} is where your company name goes.
View the October 2026 sample (PDF)
Part 1: the client note (excerpt, as written)
What happened this month. On 13 October, Microsoft released its monthly Windows and Office updates. One of the Windows problems fixed was already being used by attackers, according to Microsoft and the US Cybersecurity and Infrastructure Security Agency (CISA). It lets a harmful file sent by email or chat get past the warning Windows normally shows before you open something downloaded from the internet. Separately, CISA added several remote-access, email-filtering and backup products to its list of flaws attackers are using.
Who is likely affected. Any business with Windows PCs. Also any office running Windows 11 Home or Pro, version 24H2: Microsoft lists 13 October 2026 as the end of updates for that version, so those PCs need to move to a newer version to keep getting security fixes.
One thing for staff to do this week. If you get a file or link you weren't expecting, even from someone you know, check with the sender by phone or a separate message before you open it. Don't count on Windows to warn you.
What {MSP name} is doing: [you fill this in with what you have actually done]
The note has no CVE tables. You add one line about your own work and send it.
Part 2: the patch-first list (summary)
For your technical team only. October's list had 10 findings: nine P1 and one P2. Each one comes with fixed versions, any vendor workaround, how to confirm the fix took, and links to the vendor advisory.
P1, first response (24–72 hours)- 1Windows Shell: Mark of the Web bypass (CVE-2026-96951)
- 2Fortinet FortiMail: unauthenticated file write (CVE-2026-104286)
- 3Cisco Secure Email Gateway: file write through an email attachment (CVE-2026-76519)
- 4Ivanti Connect Secure VPN: authentication bypass to command execution (CVE-2026-104935)
- 5Palo Alto Networks PAN-OS: authenticated code execution in the management interface (CVE-2026-0322)
- 6Fortinet FortiOS / FortiProxy / FortiPAM / FortiSwitchManager: CLI path traversal (CVE-2025-61624)
- 7PHP on web servers: two unauthenticated remote code execution flaws (CVE-2026-109618, CVE-2026-109619). Not part of Patch Tuesday.
- 8BeyondTrust Remote Support: improper origin validation (CVE-2026-102764)
- 9AhsayCBS backup server: authentication bypass plus command injection (CVE-2026-105134, CVE-2026-105133)
- 10Microsoft Outlook: remote code execution through the Reading Pane (CVE-2026-97749)
The ranking uses CISA's Known Exploited Vulnerabilities catalog, FIRST EPSS scores, CVSS and vendor advisories. The priority bands are my recommendations, not Microsoft or CISA deadlines. Every score, date and version in the sample is listed in a sources log with its URL and the time it was checked.
What arrives and when
You get the brief soon after Patch Tuesday, ready to use that week.
- When:
- Within 2 business days of each Patch Tuesday.
- Delivery:
- Arrives by the Thursday after each month's Patch Tuesday.
- What's in it:
- the client note and the patch-first list, as in the sample. The client-note sections, in this order: What happened this month / Who is likely affected / One thing for staff to do this week / What {MSP name} is doing.
- How many patch items:
- Varies by month. October had 10.
- Format:
- The full brief as a PDF, plus the client note as plain text in the email body so you can paste or edit it.
- Your branding:
- Edit the client note and send it under your own name. The patch-first list is for your team; please don't resell it.
- How it reaches you:
- By email from support@evulnable.com to the address you use at checkout.
I review every issue. I read and sign off each brief before it reaches you. Nothing is sent automatically, and nothing goes to your clients unless you send it.
Who it's for
- MSPs and IT consultants who look after business clients.
- MSPs who send clients a newsletter or security alerts, or keep meaning to and don't have the time.
Price
Both plans include the client note and the patch-first list.
3 months: $75, paid once up front. Works out to $25 a month. It does not renew automatically. After your third issue, you can switch to monthly or buy another 3 months.
Pay $75 for 3 monthsAll prices in USD.
Refunds and cancellation
If your first issue isn't useful, email within 7 days of getting it for a full refund. If I miss a delivery date, I refund that month. If I stop publishing the brief, I refund any month you've paid for and haven't received.
Cancel the monthly plan anytime by emailing support@evulnable.com. Billing stops before your next renewal, and you keep any issue already paid for. The 3-month plan doesn't renew.
What this is not
- Not a compliance product. It does not make you or your clients compliant with any standard.
- Not monitoring or scanning. It does not check your clients' systems. It reports what public sources say and cannot tell you what is exposed in a given network.
- Not a guarantee. It does not make anyone secure, or keep them secure.
- Not a full patch list. It covers the items to handle first. Apply the rest of each month's updates on your normal cycle.
- Not tested in your environment. Patches are not tested on your clients' systems. Confirm details in each vendor's advisory before you act.
You decide what reaches your clients.
Who makes it
I run EVULNABLE.
EVULNABLE (evulnable.com) publishes a public, ranked list of known-exploited vulnerabilities. Each CVE gets a score (EVRS) built from CISA's KEV listing, FIRST EPSS, CVSS severity and known ransomware use. The site refreshes CISA KEV and Microsoft data every 6 hours and EPSS every 12 hours, and lists every source it uses. When a source returns nothing, it says so instead of calling that a clean result. EVULNABLE is not affiliated with, sponsored by, or paid by any vendor it covers.
Not for me, because...
Not buying? One click tells me why, and that helps me as much as a sale. Each option opens an email to support@evulnable.com with the subject filled in.
Questions
Email me at support@evulnable.com.
Want to talk it through first? Email me and we'll set up a 15-minute call. Email support@evulnable.com with two or three times that suit you and I'll confirm one.