Patch management is the work of installing software makers' fixes for known flaws on every device in a company, and the software that does it. A patch is a small update that fixes a flaw. Patch management decides which patches to install first, installs them in stages, and reports which devices are still unpatched.
Many successful attacks do not need a new trick. They use a known flaw, listed publicly with a CVE number, which the software maker fixed weeks or months earlier. The victim simply had not installed the fix. So patching is one of the most effective defences, and also one of the hardest to keep up with. A company may receive hundreds of patches a month, for the operating system, browsers, office software and other tools. Each patch may need a restart, and some patches break other software.
So patch management ranks patches by risk. A flaw that attackers are already using, which is called exploited in the wild, goes first. A flaw on a device that faces the internet goes before a flaw on a device that does not. Vulnerability intelligence tells the software which flaws attackers are using now. A vulnerability scanner tells it which devices have each flaw.
Here is a typical case. An engineering college in Warangal has 1,800 Windows computers in its labs and offices. On the second Tuesday of the month, the maker of Windows releases its monthly patches. This month there are 70. One of them fixes a flaw in Windows that attackers are already using, and CERT-In, India's cyber security agency, issues a warning about it the next day. The software ranks that patch first. On the first day, it installs the patch on a test group of 50 computers. After a day with no problems, it installs the patch on the other 1,750 computers over the next two nights, after classes end. By the fourth morning, 1,760 computers are patched. The other 40 failed, mostly because they were switched off. The software tries them again, and opens tickets in the IT service desk for those that still fail. The remaining 69 patches follow over the next two weeks.
Patch management is a part of unified endpoint management (UEM). It also covers firmware, the low-level software built into a computer's hardware, through PC firmware and device management. Firms that run the IT of many small businesses patch all of their clients' computers from a managed service provider platform.