Quick answer
Most patch programs only cover the operating system and the handful of apps IT installed itself — everything else rides along unpatched until an incident forces someone to look.
- 56% of organizations still worry they are exposed to known, unremediated vulnerabilities
- Only 49% include third-party applications in their patching process at all, even though 74% have already been hit by a third-party app vulnerability
- The gap is rarely the patch tool — it is deciding, across teams, who owns what
Every patch report looks clean on the surface. Green checkmarks, a compliance percentage in the high nineties, dashboard closed for the week.
Ask a harder question and the picture changes: patched compared to what — the operating system, or every executable running on that machine?
For most IT teams, the honest answer is the operating system, plus whatever core software IT itself pushed out.
Everything else — the PDF editor a designer installed two years ago, the file-transfer client finance uses once a quarter, the browser extension nobody remembers approving — is running on borrowed time.
A patch cycle is not one event. It is dozens of overlapping ones, one per vendor, and most of them never had a ticket opened in the first place.
The patch cycle that never really finishes
Patch management has gotten faster. Organizations deploying updates within six days of release nearly quadrupled between 2023 and 2026 — from 15% to 59%, according to Adaptiva and Demand Metric’s State of Patch Management Report 2026, based on a survey of more than 200 security and IT professionals.
Speed went up. Confidence did not follow at the same pace.
Coordination, not tooling, is the bottleneck
More than 60% of organizations still rely on manual steps somewhere in the patch lifecycle, and only 8% report fully autonomous execution today, per the same report. The rest sit in between — automated enough to look modern, manual enough to leave gaps at the handoff between security, IT operations, and whoever owns a given application.
That handoff is where third-party software falls through. Nobody owns it cleanly, so nobody schedules it.
| Software layer | Usually covered? | Who owns it | If it is missed |
|---|---|---|---|
| Operating system updates | Yes, automated | IT / patch tool | Rare — flagged fast |
| Core enterprise apps (browser, VPN client, office suite) | Usually | IT | Occasional, caught in audits |
| Niche or department software (PDF tools, plugins, utilities) | Often not | Whoever installed it | Silent — found only after an incident |
| Self-installed / shadow IT tools | Almost never | End user | Invisible to IT entirely |
What a green patch report doesn’t show
Which machines actually finished the install
A push job that shows “deployed” is not the same as an install that completed on every endpoint. Laptops that were asleep, off the VPN, or mid-reboot at the wrong moment quietly drop out of the count — and stay out until someone runs a second sweep.
Which applications were never in scope
A patch policy built around the OS and a short list of approved apps will report 100% compliance against that list — and say nothing about everything outside it.
Who signed off on the exception, and why
Every fleet has machines running an old build because upgrading breaks a workflow. That exception is usually a verbal agreement, not a documented, time-boxed risk acceptance.
How long the exposure window really was
“Patched” tells you the end state. It does not tell you how many days the vulnerability sat open before that, or whether anything touched the machine during that window.
An auditor does not ask whether you have a patch policy. They ask you to prove which machines were covered, on which date, and what happened to the ones that were not. “We believe compliance is high” is an opinion. A deployment log with per-device timestamps is evidence.
A 100% compliance dashboard only measures the software you decided to count.
It’s not a discipline problem, it’s a visibility problem
Most IT teams responsible for patching are not careless. They are working from an incomplete inventory, updating what they can see and hoping the rest is small enough to ignore.
It rarely is. Every laptop accumulates software nobody logged: trial installs that were never removed, tools a contractor left behind, utilities downloaded to solve a one-off problem in 2024 that are still running in 2026.
Coordinating “who owns what” across security, IT operations, and department heads only works if there is a shared, current list to coordinate around. Without one, the 74% who call coordination their biggest issue are coordinating around a guess.
Closing the gap, in order
- Inventory before you patch.Pull a full, current list of installed software across every endpoint — not just what IT deployed on purpose.
- Rank by exposure, not by vendor.An obscure PDF tool with a public CVE is a higher priority than a mainstream app with a clean record.
- Assign an owner to every category.OS, core apps, and third-party software each need a name attached, not a shared assumption that someone else has it.
- Push from a central platform, then verify.A deployment that is only marked “sent” is not the same as one confirmed installed on every machine — close that loop with a centralized software deployment process that reports back per device.
Silent, per-device confirmation matters more than the push itself. A deployment tool that only logs “job sent” cannot tell you which of the offline, mid-update, or blocked-by-policy machines never actually received the patch — and those are exactly the ones an attacker finds first.
How INGITE helps
Cloud Software Deployment
Push software, patches, and updates across the whole fleet from one console, with per-device confirmation instead of a “job sent” assumption — including the third-party applications most patch cycles skip.
Cloud EndPoint Security
See which endpoints are actually exposed, tie that view to real deployment status, and turn “we believe compliance is high” into a number you can defend in an audit.
Do you actually know what’s still unpatched on your fleet?
Before the next patch report goes out, answer these honestly:
- Does your patch policy list every application on the fleet, or only the ones IT installed?
- Can you name, right now, every machine that did not confirm a successful install last cycle?
- If a third-party app on an employee’s laptop had a public CVE today, would you know it was there?
- Is your current exception list written down, dated, and owned — or does it live in someone’s memory?
If the honest answer to more than one of those is “no,” the problem is not effort. It is that nobody can patch software they cannot see.
What is third-party patch management?
Why do patch reports show high compliance while vulnerabilities remain?
How many organizations patch third-party applications?
What is the biggest challenge in patch management today?
Patch what you can actually see
A deployment platform that confirms every install, on every device, including the software nobody remembers approving.