# Closing the Window: Patch and Configuration Management

Most breaches exploit vulnerabilities that already had a fix available. Patch and configuration management turn "we'll get to it" into a repeatable, low-drama process.

The gap between "a vulnerability[↗](/vulnerability) is disclosed" and "an attacker starts exploiting it" keeps shrinking, sometimes to just hours. Organizations that treat patching as a scheduled, systematic process close that window far faster than those who patch[↗](/patch) reactively, one fire at a time.

 
## Why vulnerabilities pile up
 Every piece of software eventually has flaws discovered in it. A **vulnerability** is a specific weakness; **patching** is the fix the vendor releases for it. The risk isn't that vulnerabilities exist, it's the gap between a patch being available and it actually being applied across every affected system.

 
## Building a patch management[↗](/patch-management) process
  - **Inventory first.** You can't patch what you don't know you have, maintain a current list of software, versions, and where they run.
 - **Prioritize by severity and exposure.** A critical vulnerability on an internet-facing system needs same-week attention; a low-severity issue on an isolated internal tool can wait for a scheduled window.
 - **Test before wide deployment** where the system is critical enough to risk a bad update, but don't let testing become an excuse for indefinite delay.
 - **Automate where possible.** Modern operating systems and major software can largely patch themselves; manual patching should be the exception, not the rule.
  [Keep Your Devices and Apps UpdatedUpdates don't just add features, they close known security holes. A simple, low-effort routine for keeping your phone and computer current.](/keep-your-devices-and-apps-updated) 
## Configuration management: the quieter half of the problem
 Many breaches don't involve an unpatched vulnerability at all, they exploit[↗](/exploit) a **misconfiguration**: a database left publicly accessible, default credentials never changed, or overly broad permissions granted "temporarily" and never revisited. Configuration management means defining what "correctly configured" looks like for each system, and having a way to detect drift from that baseline.

 
## Cyber essentials as a baseline
 Basic cyber hygiene[↗](/cyber-hygiene) frameworks exist because a small number of preventable issues, unpatched software, weak configuration, missing access control[↗](/access-control), account for a large share of successful attacks. Meeting a baseline standard like this isn't a ceiling to aim for; it's the floor every organization should already be standing on before investing in more advanced defenses.

 
> Patch management isn't glamorous, but it's consistently one of the highest-return security investments an organization can make.