In short
A patch management process is the repeatable cycle an organisation uses to keep software up to date: inventory every device and application, assess and prioritise missing updates (using CVSS scores, the CISA Known Exploited Vulnerabilities list and vendor risk ratings), test, deploy in rings, verify that updates installed and report on what is still outstanding.
Get a quote for patch management
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why patch management matters
Software vendors publish security updates because flaws have been found. Once an update is out, attackers can study it to work out what it fixes, so the gap between a fix being released and it being exploited can be short. Devices that miss updates stay exposed long after everyone else is protected.
The NCSC's guidance on keeping devices and software up to date is plain about it: enable automatic updates where you can, install updates promptly, keep testing short, plan for firmware as well as operating systems and applications, and replace software and devices that no longer receive updates. Its wider vulnerability management guidance starts from the same principle, "update by default", and adds that deciding not to update is a senior-level risk decision.
Patching is also one of the controls that insurers, customers and certification schemes commonly ask about. Our guide to endpoint security best practices shows where it sits alongside the other controls.
The patch management process, step by step
A good process is boring and predictable. Each cycle follows the same steps:
- Inventory. List every device (laptops, desktops, servers, virtual machines, phones and tablets) and the software on each. You cannot patch what you do not know about, and an endpoint agent that reports installed software is the easiest way to keep this current.
- Assess and prioritise. Compare what is installed with known vulnerabilities and rank the gaps. Use the CVSS severity score as a starting point, then move anything on the CISA Known Exploited Vulnerabilities list, or flagged by your vendor's risk rating as likely to be exploited, to the front of the queue.
- Test. Install updates on a small group of representative devices first, including any that run line-of-business applications. Keep this short: a few days, not weeks.
- Deploy in rings. Roll out to IT staff, then a pilot group, then everyone, with servers patched in agreed maintenance windows. Critical updates under active exploitation get a fast track through the rings.
- Verify. Check that updates actually installed and that devices restarted where needed. A patch that is downloaded but waiting for a reboot does not protect anything.
- Report and handle exceptions. Record what was patched, what failed and why, and what is waiting on a decision, such as an application that needs a licence upgrade before it can be updated. Feed failures back into the next cycle.
Once routine updates flow automatically, your team's time goes on the exceptions, which is where the real risk usually sits.
What to put in a patch management policy
A short written policy turns good intentions into a routine people can follow and auditors can check. It usually covers:
| Policy area | What to decide |
|---|---|
| Scope | Which devices and software are covered: operating systems, browsers, third-party applications, firmware, servers and mobile devices |
| Timescales | How quickly each severity is applied, with a faster route for vulnerabilities under active exploitation |
| Automation | Which updates install automatically and which need approval |
| Testing and rings | Who is in each ring and how long each stage lasts |
| Restarts | How users are warned and how long they can postpone a restart |
| Exceptions | Who can approve a delay, for how long, and what compensating controls apply |
| Unsupported software | How end-of-support products are found and when they must be removed or replaced |
| Reporting | What is reported, how often and to whom |
| Ownership | Who is responsible for each part, including who accepts the risk when something cannot be patched |
Patching is one clause in a wider endpoint security policy, and the settings it relies on (automatic updates switched on, auto-run disabled, unused software removed) belong in your endpoint hardening baseline.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Third-party applications, firmware and unsupported software
Operating system updates are the easy part. Windows, macOS and mobile platforms all have mature update mechanisms. The gaps usually appear elsewhere:
- Third-party applications: PDF readers, browsers, runtimes, collaboration tools and line-of-business software that the operating system's own update service does not cover. A patching tool with a third-party catalogue closes much of this gap.
- Firmware: BIOS and UEFI updates, docking stations and other peripherals. The NCSC advises planning for firmware updates as well as software.
- Unsupported software: anything that no longer receives security updates. It cannot be patched, so it has to be removed, replaced or isolated, and the decision recorded.
- Devices that are rarely online: laptops that sit in drawers and servers excluded from automatic restarts. Coverage reports show which devices have not checked in.
Removing local admin rights helps too: if users cannot install their own software, there is less unmanaged software to patch. See endpoint privilege management.
Patch management vs vulnerability management
The two terms are often used interchangeably, but they are different jobs that depend on each other.
| Vulnerability management | Patch management | |
|---|---|---|
| Question it answers | Where are we exposed, and what should we fix first? | How do we get the fix onto every device? |
| Scope | Missing patches, misconfigurations, unsupported software and other weaknesses | Software and firmware updates |
| Typical output | A ranked list of vulnerabilities with risk scores | Updates deployed, failures and pending restarts |
| Prioritisation inputs | CVSS, known exploitation, exploit likelihood, how critical the device is | Severity, rings, maintenance windows |
| Where it stops | Identifies and prioritises; the fix is applied elsewhere | Applies fixes; does not find issues a patch cannot solve |
Put simply, vulnerability management decides what matters and patch management delivers the fix. Some tools do both on one agent; others, such as CrowdStrike Falcon Spotlight and SentinelOne Singularity Vulnerability Management, focus on assessment and hand patching to your deployment tooling. For external scanning and penetration testing, which test your systems from the outside, see vulnerability management software on our licensing site.
Is patch management the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Patch and vulnerability tools we supply
Many organisations already run an endpoint agent that can patch, which avoids a separate tool and puts patch status next to security status in one console. The options we supply include:
| Tool | What it does | Platforms and notes |
|---|---|---|
| ThreatDown Vulnerability and Patch Management | Scans for vulnerable applications, ranks findings using CVSS and CISA recommendations, and deploys updates | Runs on the ThreatDown agent and OneView console |
| Bitdefender GravityZone Patch Management | Finds missing OS and third-party patches, prioritises them and installs manually or automatically | Windows, macOS and Linux listed by Bitdefender; add-on to GravityZone |
| WatchGuard Patch Management | Finds and deploys missing patches for Windows, macOS and Linux and many third-party applications | Optional module for every WatchGuard Endpoint Security edition; see WatchGuard Endpoint Security 360 (formerly EPDR) |
| CrowdStrike Falcon Spotlight | Scanless vulnerability assessment from the Falcon sensor, ranked with CrowdStrike's ExPRT.AI rating, with patch recommendations | Assessment only; patches are deployed by your patching tools |
| SentinelOne Singularity Vulnerability Management | OS and application vulnerability assessment on the SentinelOne agent, prioritised with EPSS, the CISA KEV list and business criticality | Assessment only; Windows, macOS and Linux |
| Acronis RMM | Patching for Microsoft products and third-party Windows applications, with an optional backup before selected patches | Part of Acronis Cyber Platform, alongside monitoring and remote access |
| Absolute Secure Endpoint Resilience for Security | OS and application patch scanning and deployment, on top of Absolute's self-healing of critical agents | Resilience for Automation adds automated vulnerability remediation |
Which one fits depends on the agent you already run, your operating system mix, whether you need third-party application coverage and who will deal with failed installs. Ask us for a quote and we will compare the options for your estate.
Patching and Cyber Essentials
Security update management is one of the five Cyber Essentials controls. Critical and high-risk updates must be installed within 14 days of release, for operating systems, firmware and applications alike, and unsupported software must be removed or kept out of scope. Under the Danzell question set used for assessments opened from 27 April 2026, missing that 14-day deadline is an automatic fail. The details are on our Cyber Essentials site under Cyber Essentials patching requirements.
A patch report from your endpoint console, showing what is installed and what is outstanding on every in-scope device, is useful evidence when you prepare. Our guide to endpoint security compliance shows how patching maps to other UK frameworks.
How we help
We start with what you have: your devices and operating systems, the agent you already run, how updates are handled today and where things slip. From there we can:
- Run a first vulnerability assessment and turn the results into a short, ranked fix list
- Recommend a patching tool that fits your estate, often one that runs on the endpoint agent you already have
- Help design patch rings, restart rules and an exceptions process, and write them into a policy
- Help set up reports that show coverage, failures and unsupported software
- Arrange licensing, with pricing confirmed at quote
Contact us to talk through a patch management process for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What are the steps in the patch management process?
A typical patch management process has six steps: inventory devices and software, assess and prioritise missing updates, test them on a small group, deploy in rings, verify that they installed and devices restarted, and report on what is outstanding. The cycle then repeats, with exceptions fed back into the next round.
What is the difference between patch management and vulnerability management?
Vulnerability management finds and prioritises weaknesses, including missing patches, misconfigurations and unsupported software. Patch management deploys the software updates that fix many of them. Vulnerability management decides what to fix first; patch management delivers the fix.
How quickly should security patches be applied?
The NCSC advises installing updates promptly, ideally within a few days, and enabling automatic updates where possible. Cyber Essentials requires critical and high-risk updates to be installed within 14 days of release, and missing that deadline is an automatic fail under the current Danzell question set; the rules are explained on our Cyber Essentials site.
What should a patch management policy include?
Scope, timescales by severity, which updates are automatic, test rings, restart rules, how exceptions are approved, how unsupported software is handled, reporting and who owns each part, including who accepts the risk when something cannot be patched.
Do we need a separate patch management tool?
Not necessarily. Several endpoint security platforms we supply, including ThreatDown, Bitdefender GravityZone and WatchGuard Endpoint Security, offer patch management on the same agent and console. Others, such as CrowdStrike Falcon Spotlight, assess vulnerabilities and hand patching to your existing tools.
Still have a question about patch management?
Ask us and a member of our team will reply by email.