Patch Management

Patch Management: Plans, tests, deploys, and monitors security patches and bug fixes. The topic concerns vulnerabilitiesVulnerabilityA technical or organizational weakness that can be exploited by a threat. and their exploitability. An effective process combines inventory management, detectionDetectionThe capability to identify suspicious activity, attacks, or policy violations in time., risk-based prioritizationRisk-Based PrioritizationOrdering security work according to likelihood, impact, exposure, and business context., remediationRemediationThe correction or mitigation of a confirmed security weakness, defect, or misconfiguration., compensating controls, and verificationVerificationConfirmation that a requirement was met or a remediation achieved its intended result..

How it works and where it fits

Patch Management is a preventive, detective, or corrective security control. Its effect depends on where it sits in the architecture, which data and decisions it processes, and how it might be bypassed. A control reduces a defined risk but rarely removes it completely, so it should be combined with additional layers of protection.

Practical security relevance

Before deployment, the objective, ownership, coverage, and expected behavior should be defined. Secure defaults, controlled exceptions, logging, and periodic effectiveness tests matter more than installation alone. Operational metrics should expose both blocked or detected activity and gaps, false alerts, and effects on legitimate business processes.

Related concepts

• Vulnerability ManagementVulnerability ManagementContinuous process for the detection, prioritization, remediation, and tracking of vulnerabilities.: Continuous process for the detection, prioritization, remediation, and tracking of vulnerabilities.
• N-day VulnerabilityN-day VulnerabilityA previously disclosed vulnerability for which information or patches are available.: A previously disclosed vulnerability for which information or patches are available.
• Virtual PatchVirtual PatchBlocks the exploitation of a vulnerability via upstream protection rules, without requiring code changes.: Blocks the exploitation of a vulnerability via upstream protection rules, without requiring code changes.
• Security Technical Implementation GuideSecurity Technical Implementation GuideDetailed hardening specification from the US defense sector for systems and products.: Detailed hardening specification from the US defense sector for systems and products.