Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is Patch Management?

Definition

Patch management is the routine process of finding, prioritizing, testing, installing, and confirming software updates across every device and application a business runs. NIST defines enterprise patch management as "the process of identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization."

How It Works

NIST SP 800-40 Revision 4, Guide to Enterprise Patch Management Planning, calls patching "preventive maintenance" for technology and describes a repeatable cycle:

  1. Know what you have. An asset inventory lists every device, operating system, application, and plugin, plus who owns it.
  2. Learn what is vulnerable. Vendor notices, vulnerability scans, and CISA's Known Exploited Vulnerabilities (KEV) catalog show which systems need updates.
  3. Prioritize by risk. Not every patch is equally urgent. CISA's Binding Operational Directive 26-04, issued June 10, 2026 for federal agencies, ranks urgency by whether the asset is publicly exposed, whether the flaw is in the KEV catalog, whether exploitation can be automated, and how much control an attacker gains. Its most urgent cases allow three calendar days.
  4. Test and deploy. Routine updates go out on a schedule. Emergency patches skip the queue.
  5. Verify. Confirm the update actually installed, then rescan.

NIST also plans for assets that cannot be patched, such as old equipment, where the answer is isolation, extra monitoring, or replacement.

Real-World Example

In March 2017, the US Computer Emergency Readiness Team warned of a flaw in Apache Struts, web software Equifax used on its online dispute portal. According to the Government Accountability Office's August 2018 report, Equifax circulated the notice to its system administrators, but "the recipient list for the notice was out-of-date," so it never reached the people responsible for the patch. A scan a week later also missed the vulnerable portal. Attackers exploited the unpatched portal and began pulling data on May 13, 2017, and the breach was not discovered until July 29. They accessed personal information of at least 145.5 million people.

Why It Matters for a Small Business

Attackers casting wide nets look for whatever is easiest to break into. Verizon's 2026 Data Breach Investigations Report found that small and medium business victims of these opportunistic attacks had typically been exposed through compromised credentials (38%) or unpatched vulnerabilities in edge devices (29%), meaning equipment at the network boundary such as firewalls and VPNs. Small businesses rarely lack the patch itself. What fails is the process: nobody owns the old server, the website plugin auto-update is off, or a firewall was never on the list. The Equifax lesson scales down well. A patch only protects the systems someone knows about and actually updates.

How to Spot It / How DTS Handles It

Warning signs: no current list of devices and software, updates "whenever someone remembers," firewalls and VPNs that have not been updated in months, or no record of which patches installed.

DTS can help with keeping an asset inventory, applying updates on a schedule, fast-tracking anything on the KEV list for internet-facing systems, and verifying each install. For websites, DTS keeps WordPress core, plugins, and themes updated. See our managed IT service, and for websites, our WordPress care plans.

Related Terms

  • CVE: the ID used to track each flaw a patch fixes.
  • CVSS: a severity score, one input to patch priority.
  • Vulnerability scanning: finds what still needs patching.
  • CISA KEV catalog: flaws known to be exploited.
  • Asset inventory: the list patching depends on.
  • Plugin vulnerability: the website version of the problem.
  • Ransomware: a common result of unpatched edge devices.

Sources

  • NIST, SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology (April 2022): https://csrc.nist.gov/pubs/sp/800/40/r4/final
  • US GAO, Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach, GAO-18-559 (August 2018): https://www.gao.gov/products/gao-18-559
  • CISA, BOD 26-04: Prioritizing Security Updates Based on Risk (June 10, 2026): https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
  • Verizon, 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/Tf3/reports/2026-dbir-data-breach-investigations-report.pdf

Last updated October 14, 2026.