Patch Management

The process of identifying, testing, and applying software updates that fix security vulnerabilities, ensuring systems are protected against known exploits.

Patch management is the process of keeping software up to date by applying security fixes (patches) released by vendors. When a vulnerability is discovered and a patch is published, every day you delay applying it is a day attackers can exploit it. Most successful cyberattacks exploit known, already-patched vulnerabilities in organizations that were slow to update.

Why Patching Is Critical

The number of disclosed vulnerabilities (CVEs) is accelerating: over 48,000 in 2025, with 2026 on pace to exceed that. Each one is a potential entry point for malware, ransomware, or data theft. While zero-day exploits get the headlines, the vast majority of attacks exploit vulnerabilities where a patch has been available for weeks or months.

What Needs Patching

It’s not just operating systems:

• Operating systems: Windows, macOS, Linux
• Browsers: Chrome, Firefox, Edge, Safari
• Business software: Microsoft 365, Adobe, Zoom, Slack
• Server software: Web servers, databases, CMS platforms
• Network devices: Router firmware, firewall software, switch firmware
• Libraries and dependencies: Third-party code your applications depend on (a frequent supply chain risk)

Common Failures

• “It might break something”: Teams delay patches out of fear of compatibility issues. The risk of a known, exploitable vulnerability almost always outweighs the risk of a patch-related disruption.
• Shadow IT: Software installed without IT’s knowledge doesn’t get patched.
• End-of-life software: Products the vendor no longer supports receive no patches at all, leaving permanent open vulnerabilities.
• Manual processes: Relying on individuals to check for and apply updates leads to inconsistency and gaps.

Building a Patch Management Process

1. Inventory: Maintain a list of all software and devices (you can’t patch what you don’t know about)
2. Prioritize: Critical and high-severity CVEs on internet-facing systems come first
3. Automate: Use endpoint protection tools or dedicated patch management software to push updates
4. Test: For critical business applications, test patches in a staging environment before broad deployment
5. Monitor: Track patch compliance across your fleet and flag devices that fall behind
6. Document: Record what was patched, when, and any exceptions, supporting nDSG compliance evidence

Patch Management and Swiss Compliance

Both the nDSG and FINMA guidelines expect organizations to address known vulnerabilities in a timely manner. The BACS regularly issues alerts about actively exploited vulnerabilities affecting Swiss organizations. Having a documented patching process demonstrates the “appropriate technical measures” the law requires.