Quick Answer
Critical patches within 24 to 72 hours. If the vulnerability is being actively exploited, same day. Everything else falls into your normal cycle.
The Timeframes
Severity | Target |
|---|---|
Actively exploited | Immediately |
Critical | 24–72 hours |
High | Within a week |
Medium | Next scheduled cycle |
Low | Routine maintenance window |
Exposure Matters as Much as Severity
A critical vulnerability on an internet-facing server is a different problem from the same rating on an internal laptop. Patch by reachability first: anything exposed to the internet, then systems holding sensitive data, then internal workstations.
The Real Obstacle Is Downtime
Most businesses know they should patch quickly. What stops them is that patches need reboots, reboots interrupt work, and there's always a risk something breaks.
Two things resolve it: a standing maintenance window staff expect, and a small test group that receives patches first so problems surface before a wide rollout. Without both, urgent patches get postponed indefinitely.
Insurers Ask for Your Timeframe
Underwriters increasingly ask for documented patching SLAs and your compliance rate against them — not whether you patch, but how fast and how consistently. Worth knowing your actual numbers rather than your intended ones.
Example Scenario
A manufacturer learned Microsoft had released a critical update affecting its Windows servers. PureStack identified the affected systems, tested the update, and prioritised internet-facing and business-critical servers. Critical systems were patched within 48 hours, with minimal disruption.
How PureStack Keeps You Patched
We identify missing updates, prioritise by exposure as well as severity, test before deployment, and verify installation across servers, workstations, and cloud systems.