CyberGlossary

Defense & Operations

Patch Management

Also known as: Update management

Definition

The end-to-end process of identifying, testing, deploying, and verifying software updates that fix vulnerabilities or bugs.

Patch management covers the full lifecycle from vulnerability disclosure to verified remediation across operating systems, firmware, applications, containers, and dependencies. Mature programs prioritize patches using exploitability data (CVSS, EPSS, KEV), business criticality, and compensating controls, and ship them through staged rings to limit operational risk. Automation, change windows, rollback plans, and SLAs by severity are essential. Patching is the single highest-leverage control against opportunistic attacks; unpatched, internet-exposed systems remain the dominant cause of mass exploitation events.

Examples

  • An emergency out-of-band patch cycle for a CISA KEV-listed remote code execution flaw.
  • Phased monthly Windows patch deployment using rings: pilot, broad, then production.

Related terms