Skip to content
IT Atlas

Security · Exposure Management

Patch Management

The controlled process of testing, deploying and verifying software and firmware updates across an estate.

IntermediateUpdated 2026-09-01

Overview

Patching is where vulnerability management becomes real work. It requires inventory, rings of deployment, maintenance windows, rollback plans and compliance reporting per platform, operating systems, third party applications, firmware, appliances, hypervisors and cloud images.

Emergency patching is a distinct process from routine patching. Organisations that have not defined and rehearsed it end up improvising during the exact events where speed matters most.

How it works

  1. 01Update rings stagger exposure so regressions are caught on a small population before broad release.
  2. 02Endpoint platforms handle OS and application updates; servers are often patched with orchestration and clustered failover to preserve availability.
  3. 03Firmware and appliance updates need their own schedule and often a maintenance window with rollback media.
  4. 04Compliance reporting must be measured from the estate, not from the patch tool's own success counters.

Sequence

Deployment rings
  1. 1Inventory
  2. 2Pilot ring (IT)
  3. 3Early ring (volunteers)
  4. 4Broad ring
  5. 5Critical systems window
  6. 6Verification & reporting

Security considerations

  • Define aggressive SLAs for internet facing and known exploited issues, with an emergency path that bypasses normal change lead times.
  • Verify from a second source, a device reporting 'compliant' in one console may be excluded or stalled.
  • Track and reduce the population of unsupported operating systems and end of life appliances.

Common misconfigurations

  • Devices that never reboot, so patches are installed but not effective.
  • Deferral policies configured indefinitely for user convenience.
  • Third party applications ignored while the OS is fully patched.

IT vs OT

OT patching is constrained by vendor validation, safety cases and production windows; compensating controls and virtual patching are often the only viable option. See OT Atlas.

IT Atlas covers Information Technology. Operational Technology is covered separately at otatlas.ai.