Patch management in plain English
A patch – named after the patch you sew over a hole – is an update that fixes a flaw in software. Many patches close security gaps. Vendors release them continuously: for operating systems and programs, but also for routers, firewalls, printers, and industrial controllers.
Think of patch management as maintaining a vehicle fleet. It’s not enough for someone to top up the oil now and then. You need a list of all vehicles, fixed service dates, clear responsibilities – and a plan for recalls that must be handled immediately.
That’s exactly what patch management is about: installing updates systematically rather than ad hoc. That way, no device is forgotten, and the most dangerous gaps are closed first.
How patch management works
Good patch management is a recurring cycle:
- Inventory: You can only update what you know about. The foundation is a complete inventory of all devices, programs, and versions – including firewalls, VPN gateways, and firmware, the software permanently built into devices.
- Stay informed: Those responsible track vendors’ security advisories and warnings from the BSI (Germany’s Federal Office for Information Security). Known vulnerabilities carry a unique identifier, the CVE number.
- Assess: The CVSS score, a rating from 0 to 10, gives an initial indication of how severe a vulnerability is. Just as important: Is the system reachable from the internet? Is the vulnerability already being actively exploited?
- Test: Updates for critical systems are first tried out in a test environment or with a small group of users to avoid outages.
- Deploy: Updates are rolled out according to fixed deadlines – immediately for actively exploited vulnerabilities in internet-facing systems, otherwise on the regular schedule.
- Verify: Regular vulnerability scans – automated checks for known vulnerabilities – show where updates are missing or have failed.
Systems that can’t be updated – such as old machine controllers or software no longer supported by the vendor – need compensating measures: isolation on the network, restricted access, and a planned replacement.
A practical example
A wholesaler reliably installs updates for workstations and servers via central management. For the firewall and the VPN gateway that employees use to work remotely, however, nobody feels responsible. When the vendor announces a critical vulnerability in the VPN gateway, the update falls through the cracks.
A vulnerability assessment uncovers the gap. An analysis of the logs shows no signs of a breach. The company installs the update, adds all network devices to its inventory, and sets a rule: critical vulnerabilities in systems reachable from the internet must be fixed on an especially tight timeline.
Why does this matter for businesses?
Many successful attacks exploit vulnerabilities for which an update had long been available. As soon as a vendor discloses a vulnerability, a race begins: attackers analyze the update, develop attack tools – known as exploits – and scan the internet automatically for vulnerable systems.
Systems at the edge of the network – such as VPN gateways, firewalls, mail servers, and web applications – are particularly at risk. They are directly reachable from the internet and therefore a favorite target.
Regulations and standards also require vulnerabilities to be handled in an orderly way. NIS2 explicitly lists this among its risk management measures. ISO/IEC 27001:2022 includes control 8.8 on the management of technical vulnerabilities in Annex A, and the BSI’s IT-Grundschutz Compendium – its catalog of baseline security requirements – devotes a dedicated module to patch and change management.
Patch management can’t help at first against zero-day vulnerabilities, for which no update exists yet. What counts here is system hardening – switching off unnecessary functions and using secure default settings – and dividing the network into separate zones. As soon as the vendor delivers an update, patch management once again determines how quickly the gap is closed.
How to protect your organization
- Complete inventory: Record all systems – including network devices, firmware, and third-party software.
- Clear responsibilities: Define who is responsible for updates for each system.
- Deadlines based on criticality: Determine how quickly critical, high, and medium vulnerabilities must be closed – with priority for internet-facing systems.
- Emergency process: Plan how you’ll respond to actively exploited vulnerabilities outside the regular schedule.
- Secure legacy systems: Isolate systems without vendor support and plan their replacement.
- Verify success: Use regular vulnerability scans to check whether updates have actually been applied.
How Rootsektor can help
With a vulnerability assessment, we show you where updates are missing or outdated software is running on your network – with verified and prioritized findings instead of long scanner lists. This shows you whether your patch management works in practice and where you should make adjustments. Once the issues have been fixed, we verify the closed vulnerabilities in a free retest. You can request a fixed-price quote after scoping via our Pentest Quote page.