Patch Management
Patch management is the governed process of tracking, assessing, testing, staging and evidencing security and functional updates. Assessment weighs severity against real exploitability; CVSS 4.0 rates scores from 9.0 upward as critical. In the Microsoft world the cadence is set by the second Tuesday of each month, Patch Tuesday. It is not optional housekeeping: NIS2 names vulnerability handling and disclosure in Article 21(2)(e) as one of the minimum measures.
Patch Management in practice
A dependable process starts with a complete inventory — what is not inventoried does not get patched. Typical blind spots are appliances, hypervisors, firmware, network and storage devices, and third-party applications that sit outside operating system updates. Deployment runs in rings: a small pilot group first, then broad waves with a defined soak time, business-critical servers last and inside a maintenance window.
In the Microsoft stack, Windows Autopatch and Intune update rings handle clients, while Azure Update Manager together with Azure Arc also covers servers outside Azure. Newer systems shorten reboot windows considerably: Windows Server 2025 and Windows 11 Enterprise support hotpatching with four baseline months a year — one in the first month of each quarter, each requiring a restart — and eight hotpatch months that do not.
For Autopatch-managed devices on Windows 11 24H2 or later, hotpatching has been the default since May 2026; on Windows Server 2025 outside Azure it requires an Azure Arc connection plus virtualisation-based security with UEFI and Secure Boot enabled. Two metrics suffice for steering: patch compliance per system group and elapsed time from release to broad deployment, reported separately for critical and regular updates.
For vulnerabilities under demonstrated active exploitation, the process needs an emergency lane that trades test depth for speed — with a documented decision and a named risk owner.