Patch management
Also known as: patch management, software updates, patching, update management
Patch management is the disciplined process of keeping operating systems, applications, and firmware updated with the latest fixes -- especially security patches.
Since attackers routinely exploit known, unpatched vulnerabilities, timely patching across every device is one of the most important and cost-effective defenses a business has.
Patch management, explained at three levels
At home
Patch management means keeping your software and devices updated. Those updates often fix security holes that hackers exploit. Applying them promptly, across all your devices, closes the doors attackers try to walk through.
At work
For a business, patch management ensures every computer, phone, and piece of software gets its security updates on time. Unpatched systems are a leading way attackers break in, so staying current across all devices is a core, high-value protection.
At home
Effective patching covers not just the operating system but applications (browsers, PDF readers, plugins) and firmware, since attackers target all of them. It balances speed (patch quickly to close vulnerabilities) with testing (avoid a bad update breaking things), often applying critical security patches fastest.
At work
MSPs manage patching centrally via RMM tools: deploying updates across all devices, monitoring compliance, and reporting on what's patched. This ensures nothing is missed, including remote devices. Prioritization focuses on critical and actively exploited vulnerabilities, and a rollback plan handles the rare problematic patch.
At home
Risk-based patching prioritizes by severity and exploitability -- actively exploited vulnerabilities get emergency treatment, while lower-risk ones follow the regular cycle. Testing in rings (pilot groups before broad rollout) balances speed against stability, and coverage extends to third-party apps and firmware that OS updates don't touch.
At work
Mature patch management combines automated deployment, vulnerability scanning to verify remediation, risk-based prioritization (severity, exploitability, exposure), phased rollout rings, and reporting for compliance and insurance. It spans OS, third-party applications, and firmware, and integrates with an overall vulnerability management program that measures mean time to patch as a key metric.
Real-world examples
At home
Marcus put off updates because they were inconvenient, leaving his systems exposed. His MSP took over patch management, quietly applying security updates across all his devices automatically -- closing vulnerabilities he didn't even know existed, without interrupting his workday.
At work
When a serious vulnerability in a common application was disclosed and immediately exploited in the wild, Nadia's MSP pushed the emergency patch to every firm device within a day via their RMM tool, then reported full coverage -- neutralizing a threat that hit slower-moving businesses hard.
Common confusions
- Patching only means updating Windows — Attackers target browsers, plugins, PDF readers, other applications, and firmware too. Comprehensive patching covers all software and firmware, not just the operating system.
- It's safer to delay updates to avoid problems — Delaying leaves known vulnerabilities open, which is how many breaches happen. The right approach is prompt patching with sensible testing, prioritizing critical and exploited flaws -- not indefinite delay.
- Turning on automatic updates is enough for a business — Consumer auto-update helps but doesn't cover all software, verify success, handle remote devices consistently, or report compliance. Managed patching ensures full, verified coverage across the fleet.
For analysts
Unpatched systems are among the most common ways businesses get breached, which makes patch management one of the highest-value, lowest-glamour security controls. Ensure your MSP patches all software and firmware across every device -- and can report coverage for insurance and compliance.
History & origin
Software has always shipped with bugs and vulnerabilities, and vendors release patches to fix them. As attackers grew adept at rapidly exploiting newly disclosed vulnerabilities, the window to patch shrank from months to days. Major incidents caused by unpatched systems underscored the stakes, and automated patch management -- often delivered by MSPs through RMM tools -- became essential for keeping fleets of devices current.