"We’re on top of patching — we do updates on Patch Tuesday" is one of the most common things we hear during an initial assessment, and it’s almost always describing a fraction of what actually needs to be covered.
What Patch Tuesday actually covers
Microsoft’s monthly release covers Windows and first-party Microsoft products. It says nothing about the dozens of other pieces of software running in a typical business: browsers and their extensions, PDF readers, backup agents, remote-access tools, line-of-business applications, and the firmware on network devices — routers, firewalls, switches — that rarely get touched at all.
The gap that actually gets exploited
In practice, we see far more real-world compromises trace back to an unpatched third-party application or a network device running years-old firmware than to a missed Windows update, simply because those are the things nobody has a process for. A monthly Windows patch cycle can create a false sense of complete coverage while the actual gap sits somewhere it doesn’t look.
What a real patch management program includes
A full inventory of software and firmware in use — you can’t patch what you don’t know you’re running — a defined cadence for each category (not just Windows), risk-based prioritization so critical, actively exploited vulnerabilities get patched faster than routine ones, and a way to verify patches actually installed successfully rather than assuming they did. Testing before wide deployment matters too; a rushed patch that breaks a critical application creates its own kind of outage.