When a hacker breaks into a corporate network, the most likely explanation is not an advanced zero-day attack. It is an update that nobody got around to installing. Known security holes that the vendor patched months ago are still being exploited on a large scale, because companies don't keep their systems up to date.

What is a patch and what is patch management?

A patch is a fix from the software vendor. It closes a hole in the code that could otherwise be exploited. Think of it as repairing a cracked window pane in your shop. As long as the crack is there, it is a potential point of entry.

Patch management is the process of systematically keeping track of which updates are available for your systems, testing them and installing them within an acceptable time frame. It sounds simple, and in principle it is. It does, however, require discipline, because it is the kind of task that can always be put off until tomorrow.

Why unpatched systems are dangerous

When a security researcher or vendor publishes a vulnerability, two things happen at once: the fix is released, and attackers begin hunting for systems that haven't been updated yet. The window from disclosure to active exploitation is often under 72 hours.

Statistically, a majority of successful attacks happen through vulnerabilities that already have an available fix. The problem is rarely a lack of solutions. It is a lack of action.

The WannaCry attack in 2017 hit more than 200,000 systems across 150 countries and cost healthcare providers, banks and logistics companies billions. The vulnerability it exploited had been fixed by Microsoft two months earlier. Companies that had not installed the update were left exposed.

What needs patching?

Most people only think about Windows updates. But your attack surface is far broader:

  • Operating systems: Windows, macOS, Linux servers
  • Browsers: Chrome, Edge and Firefox are updated frequently with security fixes
  • Third-party software: Adobe Reader, PDF readers, Zoom, Teams, Java
  • Firmware: routers, switches, printers, NAS devices
  • Servers and cloud infrastructure: application servers, web servers, databases

Firmware updates are the ones most often overlooked. A router that hasn't been updated in three years can contain critical vulnerabilities, and it faces the internet directly.

How to implement this in practice

Automatic updates for workstations

For standard Windows computers, the easiest solution is to enable automatic updates and ensure they actually run. Windows Update can be configured to install patches outside business hours so it doesn't disrupt productivity.

Test before deploying to servers

Servers require a bit more caution. An update that breaks a business-critical system is costly. The best practice is to test updates in a staging environment before rolling them out to production. If you can't, then prioritize critical security updates and install them within 72 hours, and accept the risk of compatibility issues.

Keep track of what you have

You can't update what you don't know exists. A simple inventory of your systems and software, what you have, which version, and when it was last updated, is the foundation of good patch management.

A good rule of thumb: critical security updates should be installed within 72 hours, other updates within 30 days. Put it in your IT security policy and stick to it.