Skip to content
Knowledge Hub/Article
Article

What Is Patch Management? Patches vs Updates vs Upgrades

How patch management works, how to prioritize with CVSS, CISA KEV and EPSS, what Patch Tuesday is, and how patches, updates and upgrades differ.

Oğuzhan Gerçek··7 min read
What Is Patch Management? Patches vs Updates vs Upgrades

Short answer: Patch management is the process of identifying, prioritizing, acquiring, installing and verifying the installation of patches, updates and upgrades for an organization's software and firmware. A patch is a fix for a specific vulnerability or bug; an update is a broader term that also covers such fixes; an upgrade moves the software to a new version that brings new features and possible incompatibilities. A good process starts with an inventory, ranks vulnerabilities by exploitation risk, rolls patches out in stages and measures the result.

What is patch management?

NIST's patching guide, SP 800-40 Rev. 4 (April 2022), defines enterprise patch management as the process of identifying, prioritizing, acquiring, installing and verifying the installation of patches, updates and upgrades throughout an organization. The guide's subtitle sums up the approach: preventive maintenance for technology. According to NIST, patching should be treated as a standard cost of doing business and tracked rigorously.

Banks in Türkiye also have an official definition: the information systems regulation of the BDDK, the banking regulator, defines a patch as a program add-on prepared to fix security vulnerabilities found in programs or a faulty function (Article 3). Patching and the version lifecycle of operating systems are described together in the managed operating systems entry of our glossary.

Patch vs update vs upgrade

The three terms are often used interchangeably:

  • Patch: A fix for a specific vulnerability or bug. The version line stays the same; under Semantic Versioning, the last number in 1.4.2 (PATCH) goes up only for backward compatible bug fixes.
  • Update: An umbrella term. Microsoft's software update terminology groups security updates, definition updates and service packs under the same heading, and Windows' monthly quality updates carry security and non-security fixes together.
  • Upgrade: Moves the software to a new version. In SemVer, new functionality raises the MINOR number and incompatible changes raise the MAJOR number; in Windows, feature updates that add new functionality are released once a year.

The difference matters most when support ends. Support for Windows 10 version 22H2 ended on October 14, 2025. Since then, security updates for this version come through the ESU program, an annual subscription that organizations can keep for up to three years. The lasting fix is to upgrade or replace the system. The BDDK regulation likewise requires banks to retire systems, software and devices that can no longer be updated once vendor support ends and cannot be brought to a reasonable level of security with compensating controls (Article 16(2)). We cover end-of-support planning on our OS & platform lifecycle operations page.

Why does patch management matter?

In Verizon's 2026 Data Breach Investigations Report (DBIR), exploitation of vulnerabilities became the most common initial access vector in breaches, at 31%, up from 20% a year earlier. According to the same report, only 26% of the vulnerabilities in CISA's Known Exploited Vulnerabilities (KEV) catalog were fully remediated in 2025, and the median time to full remediation rose from 32 days to 43.

NIST acknowledges that patching can interrupt operations, but it states the trade-off plainly: disruptions from patching are largely controllable, while disruptions from incidents are largely uncontrollable.

The patch management process, step by step

NIST describes the process as a life cycle. In practice, the steps run as follows:

  1. Inventory: NIST calls for up-to-date software inventories to be established and constantly maintained, and for assets with similar characteristics, such as end-user laptops, servers or IoT devices, to be organized into maintenance groups. We cover the endpoint side in our endpoint security article.
  2. Prioritization: Exploitation risk decides which vulnerability is closed first (see the next section).
  3. Testing: NIST notes that a patch may be tested before deployment; the BDDK explicitly requires banks to test patches before applying them (Article 16(1)(ç)).
  4. Phased deployment: NIST recommends phased deployments for routine patching: a small subset of assets gets the patch first and acts as canaries that surface problems early. Microsoft's deployment rings (Preview, Limited, Broad) follow the same logic.
  5. Rollback: If a patch breaks operations, it may have to be uninstalled and the previous version restored. The BDDK requires the method for resolving such problems to be defined in advance (Article 16(1)(f)).
  6. Verification and monitoring: According to NIST, deployment should be verified to confirm that the patch was installed and took effect, then monitored to confirm that it stays installed; at scale, this takes automation.

Prioritization: CVSS, CISA KEV and EPSS

Not every vulnerability can be closed at the same speed; three sources together set the order:

  • CVSS: Scores a vulnerability's severity from 0 to 10; we explain the scale in our penetration testing article. FIRST asks users to enrich the Base score with Threat and Environmental metrics, because the same vulnerability does not carry the same risk in every organization.
  • CISA KEV: The catalog maintained by the US Cybersecurity and Infrastructure Security Agency lists vulnerabilities that have a CVE ID, reliable evidence of active exploitation and a clear remediation action. CISA recommends that organizations use the catalog as an input to prioritization; according to NIST, US federal agencies must remediate new additions to the catalog within two weeks.
  • EPSS: FIRST's model estimates, every day, the probability that a published CVE will be exploited in the wild in the next 30 days. According to FIRST, EPSS relates only to the threat component and should never be treated as a risk score.

For organizations that handle card data, the timeline is set: according to the PCI SSC, PCI DSS requirement 6.3.3 sets time frames for installing security patches, and those for critical vulnerabilities must be resolved within one month of release. The organization does not have to accept risk rankings assigned by external sources (6.3.1). We describe how vulnerabilities are found on our vulnerability scan page.

Microsoft Patch Tuesday and emergency patches

Microsoft publishes its monthly security update on the second Tuesday of each month, typically at 10:00 AM Pacific Time; the release is known as Patch Tuesday or Update Tuesday. The packages are cumulative, so the latest one also includes earlier security fixes. Out-of-band updates are released for vulnerabilities that cannot wait.

Alongside the routine schedule, NIST defines three more scenarios: emergency patching in a crisis, emergency mitigation that temporarily reduces the risk before a patch is available, and isolating assets that cannot easily be patched. For an internet-facing web application, one temporary measure can be virtual patching with a WAF.

How do you measure patch management?

The core metric NIST proposes is the percentage of assets patched by the deadlines in their maintenance plans, alongside the mean and median time to patch. Metrics are kept separately by asset importance (low, moderate, high); a critical server and a test machine should not share a target. For KEV vulnerabilities, an organization's own median time to remediate can be compared with the 43 days Verizon measured. The BDDK also requires regular reporting to the information security officer on patches applied or deliberately not applied, and compensating controls for the vulnerabilities that unapplied patches were meant to fix (Article 16(1)(e) and (g)).

Frequently asked questions

What is patch management? It is the process of identifying, prioritizing, installing and verifying patches for software and firmware.

What is the difference between a patch and an update? A patch is a fix for a specific vulnerability or bug. An update is a broader term that covers security patches, bug fixes and definition updates.

What is Patch Tuesday? It is the day Microsoft publishes its monthly security updates: the second Tuesday of each month.

How quickly should critical patches be applied? There is no single rule. PCI DSS requires critical vulnerabilities to be resolved within one month, and US federal agencies must remediate newly added known exploited vulnerabilities within two weeks.

Are patch management and vulnerability management the same thing? No. Vulnerability management covers finding vulnerabilities, prioritizing them and deciding on the risk response. Patching is one way to close them; configuration changes, segmentation and upgrades also reduce the risk.

Sources