The short answer: Effective patch management means applying security updates on deadlines tied to risk, testing them through staged deployment rings so they do not disrupt operations, covering every type of system rather than just Windows workstations, and keeping records that prove each patch was installed and verified. The businesses that get breached through known vulnerabilities rarely lacked a patch. They lacked a process that reached the right system in time.
This is the third article in our vulnerability management series. Earlier articles covered how to find vulnerabilities and how to decide which ones matter most. This one covers the work of actually fixing them.
Why do businesses still fall behind on patching?
Because patching looks simple and is not. Verizon's 2025 Data Breach Investigations Report found that only about 54 percent of vulnerabilities on edge devices such as firewalls and VPNs were fully remediated during the study period, with a median of 32 days to remediate. Tenable's research for the same report found that edge device vulnerabilities took an average of 209 days to patch. During that time, attackers were exploiting those same devices at nearly eight times the rate of the previous year.
The causes are familiar to anyone who has run IT for a small or midsize business. Automatic updates are switched off because one bad patch once broke a critical application. Firewalls and switches are not covered by the same tools as workstations. Laptops that rarely connect to the office miss update windows. Third-party applications update on their own schedules, or not at all. And nobody has time to confirm the patches actually installed.
What patch timelines should a business commit to?
Your timelines should follow risk, not the calendar. A practical policy for most organizations sets four deadlines.
Vulnerabilities that are known to be actively exploited and exposed to the internet should be patched or mitigated within 72 hours. Known exploited vulnerabilities on internal systems, and critical vulnerabilities on systems holding regulated data, should be addressed within 14 days. Remaining critical and high vulnerabilities should be remediated within 30 days, which also satisfies the PCI DSS v4.0.1 requirement to install critical security patches within one month of release. Everything else follows the normal monthly cycle.
These tiers mirror the logic CISA adopted for federal agencies in Binding Operational Directive 26-04 in June 2026, which ties remediation deadlines to public exposure, active exploitation, ease of automation, and potential impact. Writing your timelines into a formal patch management policy matters because auditors, examiners, and insurers will measure you against your own written standard.
How do you patch quickly without breaking production?
The answer is deployment rings. Rather than pushing every update to every device at once, you release patches in stages and watch for problems before moving to the next group.
A typical structure starts with a pilot ring of IT staff devices and a few volunteers from each department, patched within a day or two of release. If nothing breaks, the broad ring of general workstations follows a few days later. Servers and line-of-business systems come last, inside a scheduled maintenance window with a tested rollback plan and recent backups. Critical emergency patches can compress the timeline to hours, but they still go to the pilot ring first.
Most organizations align this schedule with Microsoft's monthly security release on the second Tuesday of each month, commonly called Patch Tuesday, and then handle out-of-band emergency fixes as they arrive. The goal is a rhythm predictable enough that departments know when restarts will happen and flexible enough to move faster when an actively exploited vulnerability appears.
Before deploying anything, confirm your backups. A patch that fails on a server is an inconvenience when you can restore in minutes and a crisis when you cannot.
Which systems do businesses miss most often?
In our assessments of Ohio businesses, the same blind spots appear again and again.
Network and security appliances. Firewalls, VPN gateways, switches, wireless controllers, and remote access appliances often run firmware that has not been updated since installation. These are exactly the devices attackers target most heavily, and they are usually outside the scope of workstation patching tools.
Third-party applications. Web browsers, PDF readers, Java runtimes, compression tools, video conferencing clients, and remote support agents carry a large share of exploitable vulnerabilities. Operating system updates alone leave them untouched.
Remote and hybrid laptops. Devices that rarely connect to the office network need cloud-based or agent-based patching that works over any internet connection.
End-of-life systems. Microsoft ended support for Windows 10 on October 14, 2025. Machines still running it without a paid Extended Security Updates subscription no longer receive security patches at all. The same applies to old server operating systems, unsupported firewall models, and legacy applications that pin you to outdated software.
Hypervisors, storage, and backup systems. Virtualization hosts and backup appliances are prime ransomware targets because compromising them disables recovery. They deserve the same attention as your perimeter.
Specialized equipment. Medical devices, manufacturing controllers, and building systems often cannot be patched on a normal schedule. They need network segmentation, vendor coordination, and a documented compensating control instead.
What documentation proves your patching is working?
Auditors and insurers want measurable results, not assurances. The records that matter are a written patch management policy with defined timelines, patch compliance reports showing the percentage of devices fully patched by system type, mean time to remediate by severity tier, an exception register listing anything that cannot be patched with its compensating control and review date, and verification scans confirming that patched vulnerabilities are actually gone.
That evidence pays off in practical ways. It shortens HIPAA risk analysis work, gives FFIEC examiners clear answers, supports the vulnerability assessment and testing requirements of the FTC Safeguards Rule, and helps you answer cyber insurance renewal questionnaires accurately. A business that can show 98 percent patch compliance on workstations and documented firmware updates on every firewall is in a very different position from one that says "updates are set to automatic."
When does it make sense to hand patching to a managed provider?
When patching competes with everything else your IT team does, it loses. Most internal teams are small, and patching is unglamorous work that slips whenever a project or outage takes priority. A managed provider brings automation that covers operating systems, third-party applications, and network firmware, monitoring that catches failed installs, and reporting that is ready when your auditor asks.
Patching is also only one part of a complete program. It works best when it is driven by continuous scanning, prioritized by real exploitation data, and verified after every cycle. To see how all of those pieces fit together, and how Harbour Tech runs them for clients across the region, read our complete guide to vulnerability management services for Dayton and Cincinnati businesses.
Common questions about patch management
Should we turn on automatic updates for everything?
Automatic updates are appropriate for most workstations when combined with deployment rings and reporting. Servers, network appliances, and line-of-business systems should be patched in controlled maintenance windows with tested rollback plans.
How do we patch systems that run 24/7?
Use redundancy where possible, such as clustered servers or paired firewalls that can be updated one at a time. Where redundancy does not exist, schedule short maintenance windows during the lowest-impact period and communicate them in advance.
What is a good patch compliance target?
Many mature organizations target 95 percent or higher of workstations fully patched within 30 days, with zero tolerance for known exploited vulnerabilities on internet-facing systems past their deadline.
What should we do with a system that cannot be patched?
Isolate it on its own network segment, restrict who and what can communicate with it, increase monitoring, document it in your exception register, and plan its replacement.
Close the gap between patch release and protection
Harbour Technology Consulting manages patching for businesses across Dayton, Cincinnati, Columbus, and Indianapolis, from workstations and servers to firewalls and third-party applications. Call 937-428-9234, email info@harbourtech.net, or contact our team to review your current patch coverage.
Continue reading
Vulnerability Management Services: A Complete Guide for Dayton and Cincinnati Businesses
Sources
- Infosecurity Magazine, Verizon DBIR Reveals 34% Jump in Vulnerability Exploitation
- Tenable, CISA BOD 26-04 FAQ
- PCI Security Standards Council, PCI DSS v4.0.1 Document Library
