Patch management
patching · security updates · update management · vulnerability management · security patches
The process of inventorying software, tracking published security patches and deploying them within timeframes that match the risk, without breaking production.
In practice
It all starts with an up-to-date inventory: you cannot patch what you do not know you own. Then come monitoring and prioritisation by severity (CVSS), likelihood of exploitation (EPSS) and confirmed exploitation (the KEV catalogue). Internet-facing equipment (VPNs, firewalls, email) goes first, sometimes as an emergency. Patches are tested on a sample, rolled out in waves, then the result is checked. NIST SP 800-40 Rev. 4 frames this discipline as preventive maintenance.
In March 2017, Equifax received the alert about an Apache Struts flaw and told its teams to patch within 48 hours. Yet one portal stayed vulnerable for months: attackers got in and stole the data of around 147 million people. The settlement with US authorities came to at least $575 million.
