# What is Patch Management?

> Patch management is the governed process of identifying, prioritizing, testing, deploying, and verifying software updates — including the security fixes that close exploitable vulnerabilities.

- Canonical URL: https://yellowcube.eu/glossary/patch-management/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A defensible program knows what software and versions run where, learns of relevant releases, ranks them by exploitation status and exposure rather than severity alone, tests for operational impact, deploys on a defined cadence with an emergency path, and confirms the patch was applied and remains in place.

The discipline sits inside vulnerability management but has its own failure modes: inventory gaps, update mechanisms that silently fail, dependencies that block deployment, and end-of-life software that will never receive another fix. Each of those needs a named treatment — compensating control, isolation, or replacement — not an open exception that ages indefinitely.

### Key points

- **Inventory and intake:** Maintain current records of software, firmware, dependencies, and owners; monitor vendor and authoritative advisories, including actively exploited-vulnerability catalogs.
- **Prioritization:** Weight known exploitation, exposure, asset criticality, and compensating controls over raw severity scores; define when the emergency process applies.
- **Testing and deployment:** Stage rollout, test security and functional impact, define rollback, and track coverage and exceptions with owners and expiry.
- **Important limitation:** A patch deployment report is not proof of remediation. Failed installs, pending reboots, rolled-back changes, and unreachable assets leave the vulnerability open, and unsupported software cannot be patched at all.

### Related terms

[Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>) · [Common Vulnerabilities and Exposures (CVE)](<https://yellowcube.eu/glossary/common-vulnerabilities-and-exposures/>) · [Virtual patching](<https://yellowcube.eu/glossary/virtual-patching/>) · [Vulnerability scanning](<https://yellowcube.eu/glossary/vulnerability-scanning/>) · [Security misconfiguration](<https://yellowcube.eu/glossary/security-misconfiguration/>)

### Sources

[NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning](https://csrc.nist.gov/pubs/sp/800/40/r4/final) · [CISA, Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.