Why Staying Current on Smallworld GNM Is About Risk, and Not an Option

Enterprise GIS Platforms built on GE Vernova’s Geo Network Management (GNM) software incorporate multiple third party components, including orchestration software, container software, and virtual machines. Each of these components follows its own release cadence. The GNM software stack is baselined and validated against specific versions of these components, with release documentation clearly identifying the tested and supported operating systems and software stack for each version of the GNM Suite.

Due to regulatory requirements, many customer platforms remain confined to older versions of software. This creates exposure to several common information-security vulnerabilities and exposures (CVEs) and unsupported components. To mitigate these risks, software updates should be treated as a continuous compliance process, ensuring remediation of vulnerabilities and maintaining compatibility across the platform.

At every release of the GNM Suite, GE Vernova provides fixes for known issues and addresses published CVEs, with the goal of achieving zero critical or high CVEs at the time of release. The level of exposure within a customer’s Enterprise GIS platform is directly tied to the release version of the GNM Suite in use.

This blog highlights the compliance risks associated with not updating systems regularly and provides vendor recommendations to ensure regulatory alignment, reduce exposure to vulnerabilities, avoid catastrophic system failures, and lower total cost of ownership.

We acknowledge that regulatory constraints may limit system upgrades to defined lifecycle periods (e.g., five years). However, we strongly recommend that the upgrade of the GNM product suite be treated as a continuous compliance process rather than a one time lifecycle event. Regular updates are essential to remediate exposure to published CVEs, ensure ongoing compliance with regulatory and industry standards, and maintain continuity of vendor support. By adopting a proactive update strategy, customers can reduce risk, safeguard system integrity, and sustain long term operational resilience.

In today’s landscape, new CVEs are recorded daily across virtually every software component. These vulnerabilities are typically addressed through patches or subsequent releases of the affected software. However, applying fixes to older versions of components is often complex and costly, making reliance on outdated software a significant compliance risk.

The GNM product suite delivers frequent updates specifically designed to resolve issues and remediate vulnerabilities. By keeping software versions current, customers can substantially reduce exposure to CVEs, maintain compliance with regulatory and industry standards, and ensure continuity of vendor support.

The following image illustrates the growing volume of published CVEs, underscoring the importance of proactive updates and continuous lifecycle management.

The risk associated with unaddressed CVEs compounds over time, often growing exponentially. This escalation can significantly increase the total cost of ownership and create a high probability of unrecoverable loss or extended system downtime.

Key risk drivers:

Once vulnerabilities are publicly disclosed, continued operation without remediation represents a deliberate acceptance of known risk. This not only heightens exposure but also undermines compliance and system resilience.

Business and compliance impact

If vulnerabilities remain unaddressed, the risk profile of the system will continue to escalate, leading to:

While compensating controls may help reduce exposure, they cannot eliminate the inherent risk of operating with unsupported software components. Continued reliance on outdated versions represents a conscious acceptance of known vulnerabilities and undermines both compliance and system resilience.

These controls reduce exposure but do not remove the root cause.

Strategic Remediation (Recommended)

Upgrade the platform to a fully supported software version to:

This action directly addresses the identified risks without altering system functionality.

Controlled Delivery & Change Assurance

To safely deliver and sustain the remediation, a minimum level of deployment automation is required.

Purpose of automation:

This capability functions as a security and change control mechanism, not as a platform uplift or transformation.

Below graphs shown representation of two systems with respect to exposure to CVEs:

Note: This is a general, indicative representation based on exponential growth in CVEs and not corelated to real data.

Without Remediation

Given the exponential growth in CVEs (~48,000 in 2025 alone, nearly 4600% growth in the past 25 years according to the data reported on CVE Year Analysis) and the reliance on multiple components to build an enterprise platform, it is critical to update systems regularly to remain compliant and reduce operational risk.

What we recommend

Run N or N-1. Not N-3.
N-1 is a floor, not a target. It buys you a release that has been running in production across the install base, with the validation matrix confirmed against current operating system and container versions. It also means you are carrying whatever release N fixed, so hold N-1 for months rather than years. If you are more than two releases back, exposure is accumulating faster than any patch program can absorb.

Between upgrades, deployment automation does the heavy lifting. Repeatable deployment turns a security fix from a project into a change ticket. That is what makes a continuous update posture affordable, and it is why we treat automation as part of the security program rather than as a platform enhancement. The initiative to automate software updates should be treated as a core requirement for security remediation and supportability maintenance, rather than as a system uplift activity.

This approach delivers the following benefits:

Continuous GNM updates are a security imperative and therefore treating upgrades as ongoing compliance work, rather than one-time lifecycle events, eliminates known CVEs, preserves vendor support, and keeps platforms audit ready. As vulnerabilities grow exponentially, proactive maintenance is the only sustainable path to reduced risk, lower total cost of ownership, and long-term operational resilience.