Patch Management
In short
Patch management is the defined process for identifying, testing, installing and verifying security updates for operating systems, software and devices. It answers three questions: which updates are missing, by when they must be installed, and how you prove that it worked. Without that process, known vulnerabilities stay open even though the fix has long been available.
What the process looks like
Inventory: which devices and applications exist at all? Assess: which updates close critical gaps? Test: does the industry software still run afterwards? Deploy: in fixed windows, critical updates immediately. Verify: has every device really received the update?
Microsoft publishes its regular security updates for most products on the second Tuesday of every month, and many businesses set their rhythm by it.
The most common misconception: automatic updates are enough
Automatic updates cover the operating system, but often not the firewall, printers, NAS devices, industry applications or servers without a restart window. That is exactly where gaps stay open for a long time.
And some systems will soon get no regular updates: extended support for Windows Server 2016 ends on 12 January 2027, after which security updates are only available through Microsoft's paid Extended Security Updates programme (Microsoft Lifecycle, announcement of 25 February 2026). Patch management therefore also includes the list of systems that have to be replaced.
The Swiss legal position
Anyone processing personal data must protect it through appropriate technical and organisational measures (Art. 8 FADP). Security updates are therefore not an optional extra but the practical discharge of a legal duty – and a documented process is the proof.
How we handle it
For us, patch management is part of day-to-day operations: scheduled updates, monitoring and an alert when a device falls behind. More under managed IT and IT outsourcing.
Related terms
A term in your quote that nobody explained?
In a strategy call we translate the offer in front of you – even when it did not come from us.