IT glossary
Patch management
Patch management is the routine of keeping software updated, tracking which updates exist, testing them, installing them, and confirming they landed.
A patch is a fix issued by a software vendor. Some correct bugs, some add features, and some close a hole that is already publicly known. The third kind is the reason this has a name and a process rather than just happening.
The hard part was never installing updates. It is knowing what you have. Most organizations are surprised by their own inventory: the server nobody logs into, the design workstation running an old operating system because the plotter driver needs it, the firewall whose firmware has not been touched since it was installed.
Why it matters to you
Because it is the least interesting control that does the most work. The great majority of successful intrusions use a weakness that had a fix available, sometimes for months. Consistent patching is what removes that whole category, not cleverly, just reliably.
It is also the thing auditors, insurers and enterprise clients ask about in writing. “We patch regularly” is not an answer. “Servers monthly, workstations weekly, internet-facing systems within seven days of a critical release, with a monthly report showing compliance” is.
What good looks like
- A current list of every device, server and network appliance, and who owns it
- A defined schedule per category, with faster handling of anything internet-facing
- A test group before a broad rollout, so a bad update does not take out the whole office
- Reporting on what failed to install, which is where the risk actually accumulates
- A named plan for the systems that genuinely cannot be patched
The exceptions are the real work
There is almost always something that cannot be updated: a machine tool controller, a clinical device, an old application the vendor no longer supports. Pretending otherwise is how patch policies become fiction.
The honest approach is to list those exceptions, isolate them on the network so they are not reachable from everywhere, and put a review date on each one. An exception that has been reviewed is a managed risk. An exception nobody has written down is just a surprise waiting for a quiet week.
The measure that matters
Not “are updates enabled”, but “what percentage of our devices are current this month, and which ones are not”. If nobody can answer that in a couple of minutes, the process is running on hope.