Patch Management

What is Patch Management?

Patch management is the systematic process of identifying applicable software updates and security patches, testing them for compatibility, prioritizing them by risk, and deploying them to all affected systems within defined timeframes. It is one of the most fundamental and highest-impact security practices available: the vast majority of successful cyberattacks exploit known vulnerabilities for which patches have been available — sometimes for years. CISA's Known Exploited Vulnerabilities (KEV) catalog documents hundreds of vulnerabilities actively exploited in the wild, most of which have available patches. Effective patch management directly reduces the attack surface available to attackers without requiring any additional defensive tooling.

Description

Patch management spans multiple technology categories that each present different operational challenges. Operating system patching is the most mature domain, with established update mechanisms (Windows Update, RHEL Satellite, Ansible) and well-understood testing workflows. Application patching — covering web servers, databases, middleware, and third-party software — is more complex because patch impact testing requires application-specific validation. Container security patching requires updating base images in CI/CD pipelines rather than patching running instances. Network device and appliance patching often requires maintenance windows that disrupt operations, creating deferred patching backlogs. Firmware security patching for IoT and OT devices may require physical access or device replacement. Effective patch management requires: continuous vulnerability scanning to identify missing patches; vulnerability prioritization using CVSS, EPSS, and CISA KEV to focus effort on critical and exploited vulnerabilities; documented patch deployment SLAs by severity; testing environments for patch validation before production deployment; exception management for systems that cannot be patched without business disruption; and compensating controls for unpatched systems that remain exposed.

Usage and Examples

The 2017 WannaCry ransomware outbreak exploited EternalBlue, a vulnerability in Windows SMB for which Microsoft had released a patch (MS17-010) two months prior. Organizations with effective patch management — including the NHS, FedEx, and Telefonica — suffered significant disruptions while those that had patched were unaffected. The pattern repeats consistently: Log4Shell (2021) affected organizations running unpatched Log4j for months after patches were available; ProxyLogon (2021) affected organizations that had not applied Exchange Server patches; and MOVEit Transfer (2023) exploitation targeted organizations using unpatched versions of the file transfer software. Each incident demonstrates the compounding cost of delayed patching compared to the operational cost of timely patch deployment. Log4j update guidance from Evolve Security provided actionable patching guidance during the Log4Shell crisis.

How Does This Relate to Penetration Testing?

Unpatched vulnerabilities are consistently among the highest-severity findings in penetration testing engagements. External network assessments regularly identify internet-facing systems running software with known exploits available in public exploit databases. Internal network assessments find unpatched internal servers, missing Windows security updates on domain-joined endpoints, and legacy systems running end-of-life software with no available patches. Post-engagement, vulnerability findings mapped to specific CVEs with available patches provide a concrete, prioritized patching roadmap. The continuous penetration testing model addresses the gap between annual assessments: vulnerabilities introduced between tests accumulate until the next engagement unless continuous scanning validates patch status between assessments. Evolve Security's network penetration testing engagements identify unpatched vulnerabilities on internet-facing and internal systems — providing a prioritized remediation roadmap aligned to real-world exploitability.