Here’s a fact that should change how you think about security spending: most successful attacks don’t use anything new. They exploit vulnerabilities that were publicly known — with fixes available — for weeks, months, sometimes years. The attacker didn’t outsmart anyone; they walked through a door whose lock had a free replacement sitting in the update queue. Patch management is the discipline of installing those locks on schedule, and it is, dollar for dollar, the highest-value routine in all of IT — precisely because it’s boring enough that businesses skip it.

How the race actually works

When a serious flaw is discovered in Windows, a firewall, or a business application, the clock starts: the vendor ships a fix, the fix is publicly announced — and that announcement is also a map for attackers, who reverse-engineer patches to find exactly what they fixed. Within days, automated scanners are sweeping the internet for systems that haven’t updated yet. Not targeted attacks — weather. Exposed and unpatched is a condition scanners find on their own, at scale, and it’s a primary door in the ransomware playbook. The race is between your patch cycle and their scan cycle, and their scan cycle is fast.

What a real patch process covers

“We have automatic updates on” is where most businesses stop, and it covers maybe half the surface. The full inventory of things that need patching:

  • Operating systems — the half automatic updates does cover, unevenly, with no one confirming
  • Applications — browsers, Office, PDF readers, and the line-of-business software whose updates require coordination with the vendor rather than a checkbox
  • The infrastructure everyone forgets — firewalls, switches, Wi-Fi gear, and especially VPN appliances, whose vulnerabilities are among the most actively hunted on the internet; the device protecting your network needs protecting most
  • Servers, where “just reboot it” collides with “the whole company is on it” — which is why servers need scheduled maintenance windows, not optimism
  • The stragglers — the laptop in a drawer, the machine that’s been off for a month, the unmanaged device nobody inventoried. Coverage you can’t verify is coverage you don’t have.

A real process, then, has four verbs: inventory (know everything that needs patching), schedule (a monthly cycle for routine fixes, aligned to vendors’ release rhythms), expedite (a fast lane — days, not the next cycle — for actively-exploited critical flaws), and verify (a report showing what’s patched and what isn’t, because the gap between “deployed” and “installed everywhere” is where incidents live). Testing has a seat too: patches occasionally break things, so a brief soak on a few machines before company-wide rollout — and more care around business-critical apps and busy seasons — keeps the cure from becoming its own outage.

The exceptions are the real management

Every environment has systems that can’t be patched promptly — the machine-shop controller whose vendor certifies updates slowly, the app that only runs on the old server, the software frozen by a compatibility chain. Unmanaged, these quietly become the softest spot in the building. Managed, they’re a known, contained risk: each exception named on a list, with a reason and a compensating control — segmented away from the general network, extra monitoring, restricted access — and revisited yearly, because “temporary exception” is where permanent vulnerabilities go to hide. When your insurer asks about patch cadence — and they do — the exception list with compensating controls is the difference between an honest yes and a dangerous one.

What to ask, whoever does your patching

Whether it’s a provider (patching is core to every managed plan, including ours) or an internal person, the accountability questions are the same four: What’s our patch coverage right now — what percentage of machines are current? · How fast do critical, actively-exploited fixes go out? · What’s on the exception list, and what’s compensating for each? · When did a patch last break something, and what’s the rollback story? Crisp answers mean a process exists. Hedging means “automatic updates, probably” — and now you know.

The bottom line

Patching never feels urgent, which is exactly how unpatched systems accumulate — and unpatched-but-known is the vulnerability class attackers love most, because the work of finding the hole was done for them. A monthly cycle, a fast lane for the ugly ones, a managed exception list, and a verification report: that’s the whole discipline. It will never be exciting. Neither is the burglary that doesn’t happen.