While it is tempting to patch and move on, the BlueKeep vulnerability and other malware [risks] serve as a reminder of the challenges security professionals face when tasked with protecting older software that serves a core business function.
A tension exists between the need to continue business operations using outdated and potentially vulnerable systems and the need to secure those systems such that a catastrophic breach does not occur. Both the IT and security teams are properly motivated to reach their objectives. Both are essential to the success of the organization. And both suffer when a breach occurs or the business slumps.
The necessary connection of these teams in an organization can lead to disharmony and apathy if either team feels unsupported. The IT team must charge ahead and support sales while the security team is frantically trying to keep threats at bay. The security team wants to find vulnerabilities (in people and machines) and fix them while the IT team is fielding complaints that the revenue side of the house is being bridled with "technology."
The result of either a lack of resources and time or creeping apathy looks like the use of default and simple passwords that are susceptible to brute force attacks like the ones carried out by the GoldBrute botnet. Perhaps other results are unpatched operating systems and software that hasn't been maintained because no one has had an opportunity to perform a security assessment.
Certainly, we should be concerned about BlueKeep and brute force attacks, but preparedness doesn't stop with a patch. We should also be concerned with how much support security professionals receive within an organization so they can defend and protect what the business is and does.