Patch management
noun · NIST SP 800-40 Rev. 4
Planning, testing and deploying software updates across an organization so known vulnerabilities are fixed quickly without breaking systems.
Patch management is the operational side of fixing vulnerabilities. It answers practical questions: which updates apply to which systems, who tests them, when they are installed, how to roll them back, and how to confirm that every machine actually received them. NIST SP 800-40 describes it as preventive maintenance, as routine as replacing worn parts, rather than as a reaction to each new alert.
Most organizations deploy updates in rings: first to a small test group, then to a wider pilot, then to everyone. Critical, actively exploited vulnerabilities may need an emergency process that skips some of those steps.
Example
Microsoft releases its monthly security updates on the second Tuesday of the month. An organization installs them on IT staff machines the same week, on a pilot group of users the following week, and on all workstations and servers by the end of the month, except when an update fixes a vulnerability already being exploited, which is deployed within days.
Why it matters for a SOC analyst
A large share of incidents start with a vulnerability that had a patch available, sometimes for years. When you investigate an intrusion, "was the exploited system up to date, and if not, why?" is a key question for the root cause. Systems that cannot be patched, such as legacy equipment, need extra monitoring and segmentation instead.
Related terms
- Vulnerability management
The continuous cycle of finding, prioritizing, fixing and verifying security weaknesses across an organization's systems and software.
- CVE
The public catalog that gives each disclosed security vulnerability a unique identifier, such as CVE-2021-44228, so everyone refers to the same flaw.
- Zero-day
A vulnerability that attackers exploit before the vendor has released a fix, so defenders have had zero days to patch it.
- Worm
Malware that copies itself from system to system on its own, usually by exploiting a vulnerability, without any user action.