Patch Management

Patch management is the discipline of keeping software up to date on purpose: knowing what you run, learning when fixes for it ship, deciding which matter most, and applying them across every device and server before attackers weaponize the flaws they fix. It is one of the least glamorous controls in security and one of the most consequential — the majority of exploited vulnerabilities are not zero-days but known, patchable flaws that simply had not been patched yet. Within a wider vulnerability management program, patching is the remediation arm — the stage where ranked findings actually get fixed.

How it works

A working program runs as a loop. Inventory establishes what exists — you cannot patch what you do not know you run, which is why unmanaged shadow IT is a patching problem before it is anything else. Monitoring tracks vendor releases and exploitation warnings such as CISA's Known Exploited Vulnerabilities catalog. Prioritization ranks fixes by exposure: internet-facing systems and actively exploited flaws first, measured against defined windows (days for critical, not quarters). Testing catches the update that breaks a business application, and deployment is automated wherever possible, with verification closing the loop — reported compliance and actual compliance diverge in every real environment.

How to defend with it

Treat patching as a measured service with owners and deadlines, not a background chore. Automate operating-system and browser updates, shorten the window for anything internet-facing, and report patch latency the way you report uptime. Then mind the human seam. "Update software" is one of the four behaviors CISA asks every employee to practice — a theme of each Cybersecurity Awareness Month — so users must know that real updates come from the OS or IT, silently or on a schedule. Attackers exploit exactly that habit with fake update lures: browser pop-ups and ClickFix-style pages that tell users to run a "fix" by hand, and drive-by downloads dressed as critical patches. A workforce trained to apply genuine updates promptly and to treat any update that asks for manual steps as a reportable event closes both halves of the gap: the unpatched machine and the fake patch alike.