Patch management: how delaying updates puts your company at risk

Patch management is the discipline of regularly finding the security flaws in the software you run and applying the vendor's fixes (patches) before attackers do. Why it deserves attention: according to Verizon's 2026 Data Breach Investigations Report (DBIR), exploiting unpatched vulnerabilities is now the number one way attackers break into companies, passing stolen credentials for the first time in the report's 19-year history. The short answer is that postponing an update is the most expensive saving you can make. The hard part is that closing every flaw the day it appears is impossible. The real skill is knowing which one to patch first.

The gap: more flaws, slower fixes

More than 40,000 new vulnerabilities (CVEs) were recorded in the NVD database in 2024, roughly 39% more than the year before, an average of 108 fresh flaws every day. That volume overwhelms security teams. The same DBIR shows the effect plainly: organizations fully remediate only 26% of the flaws known to be actively exploited, down from 38% a year earlier, and the median time to patch has slipped from 32 to 43 days. Vulnerabilities are piling up faster than we close them, and that widening gap is exactly what an attacker needs.

The fix existed, nobody applied it: WannaCry

The clearest lesson is WannaCry, one of the most destructive ransomware outbreaks on record. Microsoft shipped MS17-010, the update that closed the SMB flaw the worm relied on, on March 14, 2017. WannaCry hit on May 12, 2017, locking more than 300,000 systems across 150 countries within 72 hours. Look at the dates: the fix had been available for two full months. The world did not burn because there was no cure; it burned because organizations never applied it. The failure was not technical, it was visibility and process.

The cost of skipping one system: Equifax

The second lesson comes from Equifax. CVE-2017-5638, a flaw in the Apache Struts web framework, was disclosed on March 7, 2017, and a patch shipped the same day. Equifax did not apply it everywhere; days later attackers exploited it through the company's online dispute portal. They moved through the network for months, and the Social Security numbers, birth dates and addresses of 147 million people walked out the door. Equifax later agreed to a settlement of around 700 million dollars. Having a patch is not enough. If you do not confirm it landed on every system, the one server you skipped holds the door open.

The window shrank to hours: Log4Shell

Years ago you had weeks between a patch and its first exploit. Today that window is measured in hours, and Log4Shell (CVE-2021-44228) proved it. Disclosed on December 9, 2021, and rated the maximum 10 out of 10 for severity, it was being scanned for and exploited across the internet within the first hours. Because it sat in a logging library used almost everywhere in the Java world, hundreds of millions of devices were exposed, and the Mirai botnet and the Conti ransomware crew were abusing it almost immediately. Log4Shell is also a textbook software supply chain problem, a flaw inherited from a component nobody chose on purpose. The 2025 DBIR adds another warning: zero-day flaws in edge devices (the internet-facing boxes like VPNs and firewalls) made up 22% of all exploitation incidents, up from 3% the year before. On anything exposed to the internet, delay is no longer an option.

You cannot patch everything: prioritize well

With 108 flaws a day, patching all of them at once is neither possible nor necessary. The skill is prioritization. Most teams look only at the CVSS score. CVSS rates how serious a flaw would be if exploited, on a scale of 0 to 10, but it says nothing about whether anyone will actually exploit it, and the large majority of flaws tagged critical are never used in the wild. Two extra signals change the picture. The first is the CISA KEV list, a free, public catalog of vulnerabilities proven to be under active exploitation. The second is EPSS, a score that estimates the probability a flaw will be exploited in the next 30 days; 96% of the flaws scoring under 10% on EPSS were never exploited. The practical rule: patch the flaws that are on KEV, exposed to the internet and high on EPSS first.

CISA KEV: a free priority filter

CISA, the US cybersecurity agency, issued directive BOD 22-01 in 2021, requiring federal agencies to close the flaws on the KEV list within set deadlines (14 days for most). In June 2026 it replaced that with BOD 26-04: instead of a flat deadline there is now a risk-based, tiered model, and for flaws that are internet-facing, automatable and actively exploited the deadline is just three days. That obligation binds only US government bodies. But the KEV list is public, and any company can use it as a free "close these first" filter. Once a flaw lands on that list, the time for debating how serious it is in theory is over, and it is time to schedule the patch.

What a good patch process looks like

A solid patch process has six steps. First, inventory: you cannot patch what you do not know is running, or the version it runs (this was the real gap in WannaCry). Second, sources: watch vendor security bulletins and the KEV list regularly. Third, prioritize: rank by KEV membership, internet exposure and EPSS. Fourth, test and schedule: try critical patches in a limited environment first, then roll them out in a planned maintenance window. Fifth, verify: confirm the patch actually applied, and applied everywhere. Sixth, end-of-life software: for old operating systems and libraries that no longer receive patches, the only fix is replacement, because no update is ever coming.

Common mistakes

A few habits leave even a well-meaning team exposed. The most common is "if it works, don't touch it," postponing updates indefinitely. The second is thinking only of servers and laptops while forgetting the firewall, the router, the printer and the IoT devices, exactly the internet-facing gear attackers increasingly come through. The third is never patching production at all out of fear of breaking something, which only grows the risk. The fourth is Equifax's mistake: applying a patch in one place and missing it elsewhere. The fifth is running software past its end of life; an old Windows build or an unpatched PHP version is what the OWASP Top 10 calls a vulnerable and outdated component, a door you think is shut but that stays open forever.

Patch management is the cheapest and most neglected security investment there is, because most breaches come not from zero-days but from known flaws that sat waiting for a patch for months. At Wedevit we take an inventory of your systems, map your internet-facing assets and the versions running on them, set up a KEV- and EPSS-based prioritization with a proper patch and maintenance window, and flag the end-of-life systems that need replacing. It works best as one layer of a broader zero trust approach, not a fix on its own. The concrete first step: list every system exposed to the internet and write the software version next to each one, because you cannot patch a server you cannot see.