Patch management is the process a company uses to identify, test, install and verify the updates that software vendors release to fix flaws. A security patch is one of those updates: it closes a specific vulnerability in an operating system, an application or a device before someone uses it to break in. When it is well organized, patch management repeats every month, prioritizes by severity and leaves a record of which devices are up to date.
Exploiting known flaws is now the number one way attackers get into companies. In Verizon's 2026 Data Breach Investigations Report, it accounted for 31% of initial access, up from 20% the year before, ahead even of stolen credentials.
What a security patch is
When a carmaker discovers a brake defect in one of its models, it issues a recall to every owner and fixes it free of charge. The notice goes out, but if the car never makes it to the dealership, the defect stays there, even though the fix has existed for months. A security patch works like that recall: the vendor has already found the problem and already has the fix; someone just needs to install it.
The flaw it fixes is called a vulnerability, and the ones that are made public receive a CVE (Common Vulnerabilities and Exposures, the global catalog of vulnerabilities) identifier and a severity score from 0 to 10. As soon as a vendor releases a patch, attackers also learn where the flaw is, so the clock starts ticking for every company that has not installed it yet.
Types of patches
Not every update carries the same urgency. Telling them apart helps you avoid two mistakes: holding back a critical patch out of caution or treating a cosmetic improvement as an emergency.
| Type | What it fixes | Urgency |
|---|---|---|
| Security | A vulnerability that allows someone to get in, steal information or take control of the device. | High; immediate if the flaw is already being exploited. |
| Bug fix | Functional issues: unexpected crashes, slowness, incompatibilities. | Medium; goes into the normal cycle. |
| Feature | Adds or changes capabilities in the software. | Low; scheduled when convenient. |
| Cumulative | Bundles several earlier patches into a single update. | That of the most severe patch it includes. |
Beyond the operating system, you also need to patch third-party software (browsers, PDF readers, video conferencing tools), the firmware of network devices such as firewalls and VPNs, and your servers. Patches fix flaws in the code; the insecure default settings that each device ships with are closed through a different practice, system hardening.
Why patches go unapplied
Almost no company stops patching out of carelessness. What happens is that the process collides with day-to-day operations. According to the same Verizon report, the typical time to fix vulnerabilities that were already being exploited rose to 43 days (the median), and only 26% were fully remediated. These are the most common obstacles and how to solve them:
Fear of breaking something. A patch that takes down the billing system in the middle of month-end close stays in the memory of any IT team. The answer is to test first on a small group of devices and expand afterward, instead of postponing.
Devices nobody has on the list. The test server that was left running or the laptop a department bought on its own never get updates, because they do not exist as far as the process is concerned. Without an inventory, there is no patch management.
Laptops that are hardly ever in the office. With remote work, waiting for a device to connect to the internal network no longer works. Patches have to reach devices over the internet, wherever they are.
No window to reboot. Many patches require a restart, and nobody wants to shut down a server during business hours. The fix is to agree on fixed maintenance windows that every department knows about.
Third-party software gets forgotten. Windows updates itself almost automatically, but the PDF reader or the VPN client does not. That is where a large share of exploited flaws live. The most cited example of what it costs to fall behind is WannaCry, which got in through a flaw that had a patch available two months earlier, as we describe in our article on what ransomware is.
Patch management, month by month
Patch management works best as a cycle with fixed dates instead of a reaction to every alert. This calendar fits most companies:
| When | What happens |
|---|---|
| All month | Keep the inventory up to date: which devices, which software and which version. |
| Second Tuesday | Microsoft releases its monthly patches; other vendors release on their own schedules. |
| Days 1 and 2 after | Review the severity of each patch and prioritize: critical flaws already being exploited come first. |
| Days 2 to 5 | Install on a pilot group of devices from different departments and confirm nothing breaks. |
| Second week | Roll out to the remaining devices and servers, in groups, during the agreed windows. |
| End of month | Measure how many devices are up to date, chase down the stragglers and report to leadership. |
Critical flaws that are already being exploited do not wait for the next Tuesday. For reference, the US Cybersecurity and Infrastructure Security Agency (CISA) gives federal agencies two weeks to fix the vulnerabilities in its catalog of known exploited flaws. For a company, the reasonable target is to address them within days.
The pilot group is the step most often skipped and the one that prevents the most problems. A distributor with 150 devices, for example, installs the monthly patch on eight devices from different departments; one of them, in collections, stops printing invoices. The rollout is paused, the vendor's fix is applied and the rest of the company never notices. TecnetSOC's patching module automates this entire cycle.
Patch management vs vulnerability management
The two terms are used interchangeably, but they answer different questions. In the car analogy, vulnerability management checks which models have defects and which ones are serious; patch management takes each car to the dealership.
| Aspect | Vulnerability management | Patch management |
|---|---|---|
| Question it answers | What weaknesses do I have, and which ones matter most? | How do I install the fix without disrupting operations? |
| Scope | Software flaws, insecure configurations and unsupported devices. | Only flaws that already have a patch. |
| Outcome | A list prioritized by risk. | Updated devices and evidence of compliance. |
Each one feeds the other: vulnerability analysis tells you what to patch first, and patch management gets it done.
Both are part of the most widely used security frameworks. In the CIS Controls, for example, continuous vulnerability management is Control 7, one of the controls every basic program should cover, as we detail in our guide to the CIS Controls.
Frequently asked questions about patch management
Patching means installing the update that fixes a flaw in an application, an operating system or a device. Like a patch on a piece of clothing, it covers a hole without changing everything else.
It is a flaw that attackers know about and exploit before a patch exists. Until the vendor releases one, defense depends on other layers: endpoint protection, monitoring and limited permissions. As soon as the patch comes out, it is treated as top priority.
When a vendor ends support for a product, it stops fixing its flaws, as happened with Windows 10 in October 2025. Those devices pile up vulnerabilities with no fix, so they need to be upgraded, isolated from the network or covered by paid extended support while they are replaced.
Yes, to a large extent: inventory, downloads, staged installation and compliance reporting can all be automated with device management tools. What is worth keeping in human hands is prioritization and the decision to stop a rollout if the pilot group fails.
The IT team runs the process, but each department must accept the maintenance windows and flag critical systems that cannot be restarted. Leadership approves the policy and receives the compliance report every month.
A SOC (security operations center) identifies which devices have exploitable flaws, prioritizes by risk and watches for anyone trying to exploit them while they are being patched. Some also handle deploying updates, like our SOC as a Service.
