A patch is a software update that fixes a bug or closes a security hole. Vendors release patches when they discover flaws. Sometimes the flaw is minor and the patch is routine. Sometimes the flaw is critical and the patch is urgent. The difference matters. A remote code execution flaw in an internet-facing service needs to be patched within hours. A cosmetic bug in an internal tool can wait for the next maintenance window.

Patches are not optional. The vast majority of successful attacks exploit known vulnerabilities that had patches available. WannaCry in 2017 spread through a Windows flaw that Microsoft had patched two months earlier. Organizations that had not applied the patch got hit. The ones that had were immune. The same pattern repeats every year. Attackers scan for unpatched systems because they are easy targets. Patching is unglamorous work. It requires testing, scheduling, and sometimes reboots. It also prevents more breaches than almost any other control.

Patch categories

• Security patches — fix vulnerabilities, highest priority
• Bug fixes — correct functional defects
• Feature updates — add new capabilities, may introduce risk
• Firmware patches — update hardware-level code
• Emergency patches — out-of-band releases for critical flaws

Test patches before deploying them broadly. A patch that breaks a critical application is its own kind of incident.