Introduction
Most successful cyberattacks do not use new, unknown flaws. They use known vulnerabilities that already have a fix, on systems that were never patched. That window between a patch being released and being installed is the patch gap, and attackers now move through it faster than most IT teams patch.
Quick answer: Patch management is the process of finding, testing, deploying and verifying software updates across every device, server and application in an organisation. To close the patch gap, Indian businesses should keep a complete asset inventory, rank patches by risk, deploy critical and actively exploited fixes within 72 hours, automate deployment with a tool such as ManageEngine Patch Manager Plus, and keep reports that prove compliance with CERT-In and the DPDP Act.
This guide explains the patch management process, realistic patch timelines, the mistakes that leave gaps open, and how to automate patching across offices, plants and remote laptops.
What is patch management?
Patch management is the routine of keeping operating systems, applications and firmware up to date with security fixes and bug fixes from vendors. It is one part of endpoint management, which covers how every laptop, desktop, server and mobile device is configured and secured.
What is the patch gap?
The patch gap is the time between a vendor releasing a fix and that fix being installed on your systems. Every day in that gap, the vulnerability is public knowledge but your systems are still exposed.
Why monthly patching is no longer enough
Many companies still patch once a month, or whenever IT finds time. Attackers work on a much shorter clock. According to the CrowdStrike 2026 Global Threat Report, cited by ManageEngine, the average cybercrime breakout time in 2025 was 29 minutes, and the fastest was 27 seconds. Once a public exploit exists, an unpatched system can be breached and the attacker can move to other machines before the next monthly cycle begins.
Why the patch gap is dangerous for Indian businesses
Indian companies face the same global attackers as everyone else, plus a few local pressures that make slow patching riskier.
- Mixed, scattered IT. Head office, branch offices, plants and warehouses often run different Windows versions, old servers and unmanaged laptops.
- Lean IT teams. One or two administrators may look after hundreds of devices, so manual patching falls behind.
- Remote and hybrid work. Laptops that rarely connect to the office network miss updates for weeks.
- Third-party software. Browsers, PDF readers, Java, Zoom and ERP clients are patched far less often than Windows itself.
- Strict reporting rules. A breach through a known, unpatched flaw is hard to defend under CERT-In and the DPDP Act (covered below).
What an unpatched system can lead to
- Ransomware that encrypts ERP, finance and production data
- Data theft that triggers DPDP Act obligations and penalties
- Downtime in plants, warehouses and billing
- Loss of customer and auditor trust
For a wider view of today’s threats, read Top Cybersecurity Risks Businesses Need to Watch in 2026.
The patch management process: 5 steps
A reliable patch process has five stages, and it repeats every month and for every emergency fix.
[embed: node/6c907155-f24c]
1. Discover
Scan the network to find every device, operating system and installed application, including laptops outside the office.
2. Assess and prioritise
Match missing patches to known vulnerabilities. Put actively exploited flaws and critical (CVSS 9+) issues on internet-facing systems first.
3. Test
Install patches on a small pilot group that represents your main applications. Confirm that ERP, accounting and production software still work.
4. Deploy
Roll out in waves: workstations first, then servers in planned maintenance windows. Set deadlines and auto-restart rules so updates do not wait for users.
5. Verify and report
Confirm each patch installed, retry failures and produce a compliance report. Record any exceptions with a reason and an owner.
How to build a 72-hour Patch Tuesday cycle
Microsoft releases most security updates on Patch Tuesday, the second Tuesday of every month. A 72-hour cycle means critical fixes are tested and on production machines by Friday of that week.
Day-by-day plan
| When | What to do |
|---|---|
| Tuesday (Day 0) | Review the release; flag zero-days, actively exploited and critical CVEs; check which of your assets are affected |
| Wednesday (Day 1) | Deploy to a pilot group of IT and low-risk machines; watch for crashes and app issues |
| Thursday (Day 2) | Roll out to all workstations and non-critical servers |
| Friday (Day 3) | Patch critical servers in an approved maintenance window; verify and report compliance |
Patch SLAs by severity
A written service level for each severity removes debate about what to patch first. These are common starting points; adjust them to your risk appetite and audit requirements.
| Severity | Example | Target time to patch |
|---|---|---|
| Actively exploited / zero-day | Listed in CISA’s Known Exploited Vulnerabilities catalogue or a vendor alert | Within 24 to 72 hours |
| Critical (CVSS 9.0 to 10) | Remote code execution without login | Within 7 days |
| High (CVSS 7.0 to 8.9) | Privilege escalation | Within 14 days |
| Medium and low | Information disclosure, minor bugs | Within 30 days or next cycle |
What should you patch?
Everything that runs code on your network. Most gaps hide outside Windows Update.
| Area | Examples | Why it gets missed |
|---|---|---|
| Operating systems | Windows 10 and 11, Windows Server, macOS, Linux | Old or unsupported versions stay in plants and branches |
| Third-party apps | Chrome, Edge, Firefox, Adobe Reader, Java, Zoom, 7-Zip | Not covered by Windows Update |
| Business applications | SAP GUI, ERP and CRM clients, Tally, database servers | Teams fear patches will break the application |
| Servers and virtualisation | File servers, domain controllers, VMware, Hyper-V | Need planned downtime |
| Network and security devices | Firewalls, VPN gateways, routers, switches | Firmware updates are manual |
| Remote laptops | Sales and field staff devices | Rarely on the office network |
Domain controllers deserve special care, because one compromised controller exposes every user account. See our Active Directory management guide. You also cannot patch what you have not recorded, which is why patching starts with IT asset management and a CMDB.
7 common patch management mistakes and how to fix them
| Mistake | Fix |
|---|---|
| Patching only Windows | Add third-party apps, firmware and business software to the patch scope |
| No complete asset inventory | Run automatic discovery so every device is known and tracked |
| Skipping tests | Use a pilot group before company-wide rollout |
| No rollback plan | Take snapshots or backups and document how to uninstall a bad patch |
| Ignoring remote laptops | Use an agent that patches over the internet, not only on the office LAN |
| Keeping unsupported systems | Isolate or replace end-of-life operating systems that no longer get fixes |
| No proof of patching | Schedule compliance reports for management and auditors |
If patches keep breaking business apps, log each failure in your service desk so fixes are tracked. Our guide to IT ticketing systems shows how.
Patch management and Indian compliance
Timely patching is one of the clearest ways to show regulators that you took reasonable steps to protect systems and data.
CERT-In directions (2022)
CERT-In’s directions of April 2022 require organisations to report specified cyber incidents within 6 hours of noticing them and to keep ICT system logs for 180 days. Fast reporting is much easier when patch status and logs are already centralised.
Digital Personal Data Protection (DPDP) Act, 2023
The DPDP Act requires data fiduciaries to take reasonable security safeguards to prevent personal data breaches. Failing to do so can attract a penalty of up to ₹250 crore. A known, unpatched vulnerability is difficult to defend as a reasonable safeguard.
Sector regulators
Banks, NBFCs, listed companies, insurers and their vendors also follow cybersecurity frameworks from RBI, SEBI and IRDAI, which expect documented vulnerability and patch management. Check the current circular for your sector with your compliance team.
What auditors usually ask for
- A patch management policy with severity-based SLAs
- An up-to-date asset inventory
- Monthly patch compliance reports
- Records of exceptions and their approvals
This article is general guidance, not legal advice.
How to automate patching with ManageEngine
Manual patching cannot keep pace with a 72-hour target. ManageEngine offers two main tools for this, and Bless Tech implements and manages both as a ManageEngine partner.
| Tool | Best for | Key capabilities |
|---|---|---|
| ManageEngine Patch Manager Plus | Companies that need patching only | Automated patching for Windows, macOS and Linux, hundreds of third-party apps, test-and-approve workflows, deployment policies and compliance reports |
| ManageEngine Endpoint Central | Companies that want full endpoint management | Everything in patching plus software deployment, asset inventory, remote control, configuration and mobile device management |
What automation changes
- Missing patches are detected on every device automatically
- Patches go to a pilot group first, then to everyone on a schedule
- Remote laptops get updates over the internet
- Reports show patch compliance by department, location or severity
Automated patching works best alongside privileged access management to limit what an attacker can do if a gap remains. If you lack the in-house team, our IT managed services can run patching for you each month. See also what managed IT services include.
Patch management checklist
- Complete inventory of devices, servers, apps and firmware
- Written patch policy with severity-based SLAs
- Pilot group defined for testing
- Backup or rollback plan for critical servers
- Third-party application patching enabled
- Remote laptops patched over the internet
- End-of-life systems replaced or isolated
- Monthly patch compliance report shared with management
- Exceptions recorded and approved
Frequently asked questions
What is patch management in simple terms?
Patch management is keeping all your software up to date with security fixes. It covers finding missing updates, testing them, installing them and checking they worked.
How often should a business apply patches?
Apply actively exploited and critical patches within 24 to 72 hours, high-severity patches within 14 days, and the rest in your monthly cycle.
What is the patch gap?
The patch gap is the time between a vendor releasing a fix and your systems receiving it. The longer the gap, the longer attackers can use a publicly known weakness.
Is Windows Update enough for patch management?
No. Windows Update does not cover most third-party applications, firmware, Linux, macOS or many business applications, and it gives little central reporting.
What is the difference between Patch Manager Plus and Endpoint Central?
Patch Manager Plus focuses on patching only. Endpoint Central includes patching plus software deployment, asset management, remote control and device configuration.
Does patch management help with CERT-In and DPDP Act compliance?
Yes. Documented, timely patching and compliance reports help show that reasonable security safeguards are in place and support fast incident reporting.
Can a small business afford automated patch management?
Yes. Tools are licensed per device, and a managed service lets small teams outsource the monthly work instead of hiring.
Conclusion: close the patch gap before attackers find it
Attackers move in minutes; a monthly, manual patch routine leaves weeks of exposure. Indian businesses that combine a complete inventory, severity-based SLAs, a 72-hour Patch Tuesday cycle and automation can close most of that gap and prove it to auditors.
Want to know how wide your patch gap is today? Bless Tech offers a patch-gap assessment covering your devices, servers and third-party apps, with a clear remediation plan. Contact Bless Tech or explore our cyber security solutions.