Abstract
An enterprise security posture changes over time as exploits are disclosed, patches are applied, and assets age out of vendor support. Empirical incident studies indicate that many breaches follow not from a single point of failure but from a gradual decline of the posture over weeks and months. In this paper the population of protected assets in an information-technology infrastructure is modeled as a multidimensional, continuous-time linear dynamical system and analyzed for stability by the gradient-velocity vector Lyapunov function method. Robust aperiodic stability conditions are derived as an explicit system of linear inequalities in the patching, aging and recovery rates. These conditions are sufficient rather than necessary, so the divergent regime is confirmed by a direct spectral check of the model matrix. For the configuration studied it shows a single real positive eigenvalue, and exposure diverges monotonically and aperiodically; this loss of stability is interpreted as a structural, endogenous mechanism rather than an isolated random event. The same framework yields a linear feedback patch-management controller that places the closed-loop dynamics in the aperiodic robust stability class, with closed-form gains. A numerical experiment on a five-cohort asset model and a fourth-order companion-form plant shows that this controller reduces the residual-risk norm by about four orders of magnitude over twelve weeks, whereas the uncontrolled system grows by more than five. The method turns the intuition that “patching faster helps” into a quantitative structural criterion evaluable, in principle, from an enterprise’s own asset telemetry without a statistical baseline. All coefficients were assigned rather than identified from operational data and are reported in full, so the results hold within the proposed model only; empirical validation on operational data remains essential future work.