In smaller businesses, one administrator or supplier often handles updates alongside other work. Windows may update automatically while browsers, PDF readers, VPN clients and router firmware receive less attention. The goal is a predictable routine.
NIST SP 800-40 Rev. 4 describes patch management as preventive technology maintenance. Regular updates are part of operations. A routine also helps users anticipate restarts and shows management that the process works.
Start with an inventory
You cannot update what you do not know about. Create a current device and software inventory covering:
- Computers, laptops and servers, with OS versions.
- Applications, especially internet-facing and document-handling software.
- Network devices, firewalls, VPN gateways and firmware.
- Cloud services and configurations you manage.
- Devices and systems that cannot or must not be updated.
Record owners and update methods. Mark unsupported systems separately and plan replacement or isolation.
An expensive tool is not required to start. A device management export supplemented with network equipment can be enough. Regular ownership matters more than format.
Prioritise exploitability as well as scores
CVSS describes technical severity, but not whether exploitation is happening. CISA's Known Exploited Vulnerabilities catalogue records evidence of exploitation and is useful for prioritisation. It is not exhaustive: absence does not mean safety. FIRST's EPSS estimates exploitation probability.
Context matters equally. An internet-facing VPN flaw is more urgent than the same issue on an isolated computer. Prepare separate workflows for:
- Routine updates in a regular cycle, for example monthly.
- Urgent updates for exploited vulnerabilities, particularly on internet-facing systems, without waiting for the next cycle.
- Temporary mitigations when no patch exists, such as disabling a feature or restricting access.
- Unpatchable systems requiring isolation or replacement plans.
Deploy in waves
Updates occasionally cause problems. Staged deployment manages this risk:
- Pilot group: IT and willing colleagues receive updates first.
- Broad deployment: after an agreed observation period, expand to most devices.
- Critical systems: update during planned windows with backups and rollback procedures.
Adapt wave sizes and timing to your environment, shortening the cycle for urgent fixes. Include less common applications in the pilot. Define who may halt deployment and how users report problems.
Include third-party applications
The OS is only part of the picture. Browsers and extensions, office suites, PDF readers, remote access tools and runtimes have their own vulnerabilities and update schedules.
Central inventory and patch tools can help. One example APPSEC supplies and supports is Heimdal Patch & Asset Management. Other device management tools offer similar features. Verify actual system and application coverage and how clearly failed installations are reported.
Sending an update does not prove installation. Check successful deployment and devices left behind. A concise monthly management report can show patch status, exceptions and systems awaiting replacement.
Routine checklist
- A device and software inventory has an owner.
- Unsupported systems are marked and have a plan.
- Routine updates have a regular schedule.
- Urgent fixes have an out-of-cycle procedure.
- Priorities consider exploitation evidence and internet exposure.
- Deployment uses waves and a pilot group.
- Third-party apps and firmware are included.
- Installation success is checked and exceptions recorded.
We can review your current approach and propose a realistic process or management tool. Arrange a consultation.
