patch
termprogrammingops culturesecurity
A change applied to existing software to fix a defect or close a vulnerability.
The word comes from the literal era, when a patch was tape covering a hole in a punched card. In security work, patching is the least glamorous and most effective control there is, because most breaches exploit something with a fix already published. The practical difficulty is never the patch itself but the change window: proving the fix will not break production is what patch management actually consists of.
A patch is a change that fixes a defect, and the interesting part of it operationally is not the fix but the exposure window. Publishing a patch tells attackers what was wrong, since diffing the change reveals the vulnerability, so the clock starts at release rather than at disclosure.
That is why patching is a rate problem rather than a completeness problem. Most breaches use vulnerabilities patched months earlier, which means the organizations at risk are not the ones missing an exotic fix but the ones whose deployment takes weeks. Prioritization by exploitability rather than severity, and the ability to deploy quickly at all, matter more than the fraction of patches eventually applied.
Also known as: patching, security patch, update