Patch Management: What Gets Patched, How Fast, and the Updates Everyone Forgets

When we take on a new client and run the first audit, the pattern is nearly always the same. Windows is more or less up to date, because Windows nags. The laptops have a mix of driver versions from whenever they were bought. And the software people use all day has not been updated since it was installed.

A managed patching service covers four things:

1. Operating systems. Windows and macOS on every laptop, desktop and server. The monthly cumulative updates and the out-of-band fixes Microsoft and Apple release when something is already being exploited.
2. Drivers and firmware. Graphics, network, storage and chipset drivers, plus the BIOS and firmware on the machine itself. Nobody thinks of these as security updates until a vulnerability in a Wi-Fi driver lets someone on the same network in.
3. Microsoft products that are not Windows. Office, Teams, Edge, .NET and SQL Server where it exists.
4. Third-party software. Google Chrome, Mozilla Firefox, Adobe Acrobat and Reader, Zoom, 7-Zip, Java, VLC, Notepad++ and the long tail of things installed on a business PC. This is the category that matters most, because it is the one attackers reach first and the one most businesses do not patch at all.

Our own commitment is simple to state: every critical update applied within 14 days of release, and usually within 7, across all four.

The 14-day figure is not arbitrary. It is the window Cyber Essentials requires: updates that fix vulnerabilities rated critical or high risk must be applied within 14 days of release, on every device in scope, including third-party software and firmware. Miss it on one category and the assessment fails.

We aim for seven for two reasons. The gap between a patch being published and the exploit being used against it has been shrinking for years, and is often days rather than weeks for the browsers. And seven leaves room to deal with the machine that has been switched off for a fortnight, the server with a maintenance window, and the update that has to be pulled because it broke something.

A browser is the piece of software on your computer that spends its whole day opening content written by strangers. Chrome and Firefox each fix dozens of security vulnerabilities a year, several of them already being exploited when the fix ships; Google publishes them on the Chrome releases blog and Mozilla in its security advisories. A PDF reader opens files that arrive by email from people you do not know, and Adobe's security bulletins run at a similar pace.

None of those updates arrive through Windows Update. Chrome updates itself, but only when it is restarted, and a browser left open for three weeks on a desk is three weeks out of date. Firefox, Adobe and the rest depend on the user clicking a prompt they have learned to dismiss. Nobody in the business is responsible for it, so nobody does it.

The NCSC's device security guidance is blunt: unpatched software is one of the most common ways attackers get in, and responsibility has to sit with whoever manages the device, not with the person using it. That is why third-party patching is in the base price of our managed IT support, not an add-on.

The tools are less interesting than the process.

• Inventory first. Every managed device reports what is installed and at what version. Software nobody knew about is the first finding on most audits, and you cannot patch what you have not seen.
• Detect, download, install, on a schedule. Every device checks for updates at 00:00, 09:00 and 16:00 each day and downloads approved ones straight away, so nothing waits on a download. Installs run at 19:00 on Monday and Thursday, outside working hours. Antivirus definitions install immediately, any time.
• Test, then rings. Updates are approved after a short soak on our own machines and a pilot group at each client, then rolled out in rings: a handful of machines, then a department, then everyone. A bad update, and there are a few every year, hits one machine and is stopped rather than hitting forty and stopping the business.
• Reboots, handled like adults. Most security updates need a restart. Ours happen on Friday at 15:00: the user gets a message from us with a three-hour countdown, can save their work and restart sooner, and the device restarts itself at the end of the window if they do not. A machine that misses two Friday windows gets a conversation, then a deadline.
• Off-network machines stay in scope. The laptop at someone's kitchen table patches over the internet the same as one in the office. The one that has been in a drawer since Easter is patched the day it is switched on, before it is allowed near anything else.
• Servers and firmware, with care. Servers patch in a maintenance window with a snapshot taken first. Firmware and BIOS updates are done deliberately and on a schedule, because a failed one is a dead machine.
• Reporting you can show someone. Each month: what was released, what was applied, what is outstanding and why. When an insurer, an auditor or a Cyber Essentials assessor asks how you patch, the answer is a report, not a shrug.

For our clients the schedule is fixed and published: detection at 00:00, 09:00 and 16:00 every day, installs at 19:00 on Monday and Thursday, restarts on Friday at 15:00 with a three-hour warning, and antivirus definitions immediately. An update released on a Tuesday is normally installed on Thursday evening and active by Friday evening. The full patch management policy sets out scope, timescales, exceptions and reporting.

Patching closes the door attackers use most, but it is one control among several. It does not stop someone handing over their password to a convincing email, which is what phishing simulation and training is for. It does nothing for software that is out of support and no longer gets patches at all, which is why Windows 10 machines still in use are a problem we raise loudly. And it does nothing for the device nobody told us about, which is why the inventory comes first.

Ask when Chrome and Adobe Reader were last updated across every machine, and ask to see the report.

If the answer is "they update themselves", that is the gap. If the answer is a report with dates and a list of outstanding machines, patching is being done.

Not sure where you stand? The free IT Health Check benchmarks your setup in a few minutes, and patching is one of the things it looks at.