Patch management: how many holes are left a month after updates?

Windows Update ran, the server says “up to date”. The holes that remain are the ones Windows Update cannot see. What real patch management looks like.

Weekend maintenance went fine. Windows Update installed, the server rebooted, Monday morning everything runs and the system reports: up to date. Why think about it any further — updates are done.

Except the holes that remain in your network are the ones Windows Update cannot see.

Windows is one layer. Browsers, PDF readers, Java, Zoom, drivers, server firmware, the NAS in the corner, Wi-Fi routers, cameras — each has its own updates, its own vulnerabilities, and its own pace at which attackers exploit them. Most of them do not update themselves. That is what patch management is: controlled patching of everything the company runs — not just the parts that patch themselves.

Where the holes keep coming from

Software is not a finished thing — it is a thing that ages every day. Vendors keep finding (and attackers keep hunting for) flaws; every month brings fixes for dozens to hundreds of vulnerabilities across ordinary business software. Microsoft ships fixes on the second Tuesday of each month, browsers sometimes weekly, other vendors on their own schedules. And a patch is also a map for the attacker: it shows where the flaw was. That is why the time between a fix being published and unpatched companies being exploited is measured in days, not months. A network “patched as of January” is simply full of holes by July — not because anyone broke it, but because the world moved on.

Why “it updates itself” fails

Everything outside Windows Update. Windows Update sees Windows and some Microsoft products. It knows nothing about the dozens of third-party applications — which tend to be the leakiest, because nobody thinks of them.

Postponed reboots. The update downloaded but never installed, because the machine waits for a reboot the user has postponed for three weeks. The machine looks patched. It isn’t.

Machines that “must not” be touched. The PC at the production line where “nothing may change”. Understandable — but an exception without a compensating plan is not an exception. It is a permanently open window.

Things that aren’t computers. Router, NAS, printer, camera. Firmware practically never updates itself — on devices that often face the internet directly.

What our audits show

Out of 262 companies that ran our free online audit, 151 — more than half — had at least one serious finding visible from the outside: outdated, vulnerable services exposed to the internet, leaked passwords, open access points. That is the view from outside alone, without a single look inside the network. Inside, it is rarely better.

Patch management that actually works

1. Inventory. You cannot patch what you don’t know about. A list of every device and application — including that NAS.

2. Rules. What gets updated when, what is tested first, what has an exception and what compensates for it. Written rules, not “when there’s time”.

3. Automation. Beyond a handful of machines, nobody sustains this manually. Tooling handles it, including tracking what succeeded — we run this on macOS with App auto patch and the same principle on Windows.

4. Verification. A report: deployed, failed, pending. Without it, patch management is faith, not process.

Production machines that must not go down

The hardest discipline in patch management. The computer driving a production line genuinely cannot reboot on Tuesday at noon — and the machine’s vendor often forbids updates outright, on pain of losing the warranty. The answer is not “so we leave it alone”. The answer is: maintenance windows agreed with production (planned downtime, weekends), a test group — patches go first to a machine whose outage doesn’t hurt, and a separated network for machines that cannot be updated at all: if the hole cannot be closed, wall off the corridor that leads to it. And everything in writing: which exception, why, and what compensates for it. An exception without compensation is not a decision — it is debt.

How often is often enough

A rhythm that works for smaller companies: monthly, the regular round — after the second Tuesday, when most fixes ship; test group first, everyone else a few days later. Immediately (within days), outside the rhythm: critical patches for actively exploited flaws — which is why it helps to have someone reading security advisories for you. Quarterly: firmware for network gear and the NAS, plus an inventory check — did anything appear that we don’t know about? Rhythm beats perfection: a company that patches imperfectly every month is in a different league from one that does a “big cleanup” once a year.

Four questions for whoever manages your IT

If you have an IT provider (internal or external), these questions reveal the state of play in five minutes. “Do we have a list of third-party software, and who updates it?” “Who last updated the firmware on our router and NAS, and when?” — the most common answer is embarrassed silence. “How long does it take us from a patch being released to it being deployed?” Days are excellent, weeks acceptable, “we don’t know” is also an answer. “Can I see last month’s report?” Where there is no report, the state of things is guessed, not known.

Where to start if you have nothing today

You don’t need to buy tools first. Three steps for this week: turn on automatic updates at least for browsers and office applications — it is free and closes the busiest way in; find out what your network exposes to the internet — exactly what our free audit sees from the outside, with nothing to install; make an inventory — every device and application, including the boxes nobody has touched in years. Only with an inventory in hand does it make sense to talk about tooling and automation.

Patching is prevention. What if it’s too late?

Patch management closes the doors attackers walk in through. What to do about the one who is already inside — and why antivirus won’t catch him — is here: EDR: why antivirus alone is no longer enough. And what such an incident really costs: How much will a data breach actually cost you.

How many holes show from the outside? Know in 5 minutes

You don’t have to take our word for any of this. Run our free online security audit — 13 checks, 5 minutes, no meeting. Enter your company domain and see what the internet knows about your IT: leaked passwords, e-mail configuration, exposed services. The report lands in your inbox. No salesperson will call — we only get in touch if something changes for the worse.

Frequently asked questions

What is patch management in one sentence?

Controlled, documented updating of all software and devices a company runs — including everything that does not update itself and routinely gets forgotten.

What if an update breaks an application?

That is what the test group is for: patches hit a few low-risk machines first, the rest days later, with a rollback plan ready. The risk of a broken update is an order of magnitude smaller than the risk of a years-old hole.