Patch Management Best Practices

Why Patching Is Still the Most Important Control

Despite decades of emphasis, unpatched vulnerabilities remain the most commonly exploited attack vector in external network compromises. The Verizon 2025 Data Breach Investigations Report found a significant rise in breaches caused by exploited vulnerabilities, particularly in perimeter devices and VPNs. CISA's Known Exploited Vulnerabilities (KEV) catalog lists over 1,000 vulnerabilities that are actively being used in real-world attacks — the vast majority of which have been patched by vendors and are only exploitable because organizations have not applied the patch.

The Patch Priority Problem

Large organizations receive thousands of vulnerability notifications monthly. Not all of them require immediate action — treating every vulnerability as critical creates patch fatigue and prevents teams from focusing on what matters. An effective patch management process prioritizes based on actual exploitation risk, not just CVSS score:

• Critical priority (24-48 hours) — Internet-facing systems with vulnerabilities on CISA's KEV catalog, or with public exploits available
• High priority (7 days) — Internet-facing systems with high-severity vulnerabilities, internal systems with critical vulnerabilities
• Standard priority (30 days) — Internal systems with high-severity vulnerabilities, lower-risk systems
• Routine (90 days) — Medium and low severity vulnerabilities in lower-risk environments

The Patch vs. Compensating Control Decision

Not every system can be patched immediately. Legacy systems, critical production environments, and systems requiring extensive testing before patching may not be patchable on the emergency timeline a critical vulnerability demands. In these cases, compensating controls — network isolation, additional monitoring, disabling specific features — can reduce risk while a patching path is developed. The key is that these decisions are documented and reviewed, not simply ignored.

Validate Your Patching with Penetration Testing

A penetration test validates whether your patching program is actually working. External penetration tests consistently find unpatched internet-facing systems — systems that IT believed were patched but were not, systems that were missed by asset management tools, or systems where patches were applied but did not successfully address the vulnerability. These findings are not criticisms; they are the intelligence needed to close real gaps before attackers find them.