Patch management is the process of identifying, testing, and applying updates, called patches, to software and systems so that known security vulnerabilities are fixed before an attacker can exploit them. It is one of the most fundamental defenses against ransomware.
What patch management is
Software is never finished. After a program is released, security researchers and the vendor keep finding flaws in it, including vulnerabilities that an attacker could exploit to break in or take control. When a vendor finds such a flaw, it issues a patch, a piece of code that fixes it. Patch management is the ongoing discipline of making sure those fixes actually get applied across all of an organization's systems, promptly and reliably, rather than being left undone.
It sounds mundane, and in a sense it is, which is part of the problem: patching is unglamorous, routine work that is easy to defer. But it is also one of the most consequential things an organization does for its security, because an unpatched vulnerability is an open door that the attacker already has the key to. The whole point of patch management is to close those doors faster than attackers can walk through them.
Why it matters so much against ransomware
Exploiting known, unpatched vulnerabilities is one of the most common ways ransomware attacks begin. When a vulnerability becomes public and a patch is released, attackers reverse-engineer the fix to understand the flaw and then race to exploit every system that has not yet applied it. The window between a patch being released and attackers weaponizing it has shrunk to days or even hours, so a system left unpatched for weeks is highly exposed.
The historical example that still resonates is WannaCry in 2017, which spread by exploiting a Windows vulnerability for which a patch had actually been available for about two months. Organizations that had applied it were protected; many that had not, including parts of the NHS, were hit hard. The lesson was stark: the fix existed, and the damage came from not having applied it. CISA maintains a catalog of known exploited vulnerabilities precisely to help organizations prioritize patching the flaws that attackers are actively using.
Why patching is harder than it sounds
If patching is so important, why does any organization fall behind? Because in practice it is genuinely difficult at scale. A large organization runs thousands of different software products and systems, each with its own stream of updates, and applying a patch is not risk-free: an update can occasionally break a critical application or cause downtime, so patches usually have to be tested before deployment. Balancing the urgency of security against the risk of disruption, across a huge and varied estate, is a constant challenge.
Healthcare faces the hardest version of this problem. Many medical devices run software that cannot be patched at all, because the operating system is closed, the device is certified in a fixed configuration that the hospital is not permitted to modify, or the manufacturer no longer supports it. A hospital can have an exemplary patching program for its servers and laptops and still be surrounded by thousands of connected devices that are permanently unpatchable by design. This is not a failure of diligence; it is a structural reality of the device fleet, and it means patching alone can never cover a hospital's full attack surface.
Patch management within a layered defense
Good patch management follows a clear cycle: maintain an inventory of all software and systems so you know what needs patching; monitor for new patches and prioritize them by risk, especially those addressing actively exploited vulnerabilities; test patches to avoid breaking critical systems; deploy them promptly across the estate; and verify that they actually applied. Prioritization matters because not all vulnerabilities are equal, and the ones attackers are actively exploiting deserve the fastest response.
But the unpatchable reality, especially in healthcare, is exactly why patching must sit within a layered defense rather than standing alone. For the systems you can patch, patch them promptly, it closes the most common attack path. For the many systems you cannot, medical devices, legacy equipment, you need compensating controls: agentless, network-level protection that defends a device the attacker could exploit, segmentation that limits what a compromised device can reach, and behavioral detection that catches exploitation in progress. The right mental model is to patch everything you can and protect everything you cannot, because an attacker will always go for the unpatched or unpatchable system first, and in a hospital there will always be many of the latter.
Prioritization and the problem of too many patches
A practical difficulty that patch management programs run into is sheer volume. Tens of thousands of vulnerabilities are disclosed every year, and a large organization may face more patches than it could ever test and apply promptly. Trying to fix everything equally fast is neither possible nor sensible, so the key discipline is prioritization: focusing the fastest response on the vulnerabilities that actually matter. Not every flaw is equally dangerous, a vulnerability that is hard to exploit and exposed to no one is far less urgent than one that attackers are actively using against internet-facing systems.
This is why risk-based prioritization has become central to modern patching. Rather than treating a vulnerability's theoretical severity score as the only guide, effective programs weigh whether a flaw is actually being exploited in the wild, whether it affects systems that are exposed and reachable, and how critical those systems are. Resources like CISA's catalog of known exploited vulnerabilities exist precisely to tell defenders which flaws attackers are using right now, so those can be patched first. For an organization that cannot patch everything immediately, patching the genuinely dangerous things fast, and applying compensating controls to the rest, is a far stronger posture than trying and failing to keep up with every disclosure. The goal is not a perfect patch record but the closing of the specific doors an attacker is most likely to try.
See also
Sources
- CISA: Known Exploited Vulnerabilities Catalog
- National Audit Office: Investigation into the WannaCry cyber attack and the NHS
- NIST: Guide to Enterprise Patch Management Planning (SP 800-40)
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.