Glossary
Patch management
Also called: Update management, vulnerability remediation
In one sentence
Patch management is the ongoing process of installing security updates on operating systems, applications and devices — on a schedule, with tracking, so nothing is left unprotected.
Software vendors regularly fix security holes, and attackers study those fixes to build attacks against anyone who hasn't installed them yet. Patch management makes sure updates actually get installed: Windows and macOS, browsers, Office, PDF readers, practice software, and also the less obvious things — firewalls, Wi-Fi equipment, printers and network storage.
A good process has a few parts: an inventory of what you have; automated deployment with a sensible delay to avoid buggy updates; a faster track for actively exploited flaws (CISA maintains a public Known Exploited Vulnerabilities catalog for exactly this); a report showing what's installed and what failed; and a plan for systems that can't be patched because they're no longer supported, like Windows 10 PCs without Extended Security Updates.
Why it matters: unpatched systems are one of the most common ways attackers get in. The HIPAA Security Rule expects protection from malicious software, and cyber insurers often ask how quickly you apply critical patches. For practices, the challenge is that some clinical or imaging software lags behind Windows updates, so patching needs coordination with those vendors.
Tools like Intune and an RMM platform automate most of the work and produce the reports that prove it happened.
Example: a medical office's firewall had a well-publicized vulnerability being actively exploited. Because the IT provider tracks firmware on network equipment, the update was applied after hours the same week, rather than discovered months later during an incident.
Our computer replacement planner helps you spot machines that can no longer be patched.
Related terms
- RMM (remote monitoring and management)RMM is the software IT providers install on computers and servers to monitor their health, install updates, run maintenance and connect remotely to fix problems.
- Microsoft IntuneMicrosoft Intune is Microsoft's cloud service for managing and securing company computers, phones and tablets — settings, apps, updates and encryption — from one place.
- ESU (Extended Security Updates)A paid Microsoft program that keeps delivering critical security fixes to Windows 10 PCs for a limited time after official support ended.
- Vulnerability scanAn automated check of your computers, network and software for known security weaknesses such as missing updates or risky settings.
- EndpointAny device that connects to your network or data — laptops, desktops, phones, tablets and servers — and is used by a person or runs business software.
- RansomwareRansomware is malicious software that locks or encrypts your files and systems, and often steals copies of your data, so criminals can demand payment to restore access or keep quiet.