Your patch compliance rate is not a grade. It is a denominator.
A patch compliance rate is a fraction, not a grade. It reports patches applied across the assets your provider chose to count, so the denominator decides the number. Verizon found only 26 percent of known exploited vulnerabilities fully remediated, at a 43-day median. Ask what was counted, which machines are missing, and for how long.
- A patch compliance rate is a fraction. Ask what sits in the denominator before you read the percentage.
- Verizon found only 26 percent of known exploited vulnerabilities fully remediated, down from 38 percent, at a median of 43 days to close one.
- CISA's current deadline table gives three days for the highest-risk case, and the clock starts the day the flaw enters the KEV catalog.
- The missing percentage is rarely random. It concentrates on the assets nobody will reboot and the gear with no patch agent, which is the business-critical half of your estate.
- The exception register is where someone already accepted that risk for you. Every entry needs a named owner and an expiry date.
What does a patch compliance rate actually measure?
A patch compliance rate measures the share of available patches installed across the assets your provider decided to count. It is a fraction. The top number is patches applied. The bottom number is assets in scope, and that is the half nobody explains.
A denominator is just the total you divide by. In patch reporting, the denominator is the asset list. Drop the firewall, two network switches and one old line-of-business server out of scope, and the percentage climbs without a single patch being installed. Add them back and it falls. Nothing on your network changed either way. That is why the number on your monthly report is not a grade. It is a measurement of a list you have never seen.
The stakes behind the list keep rising. Verizon's 2026 report found 31 percent of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in. CISA's Known Exploited Vulnerabilities catalog, the official list of flaws confirmed as used in real attacks, held 1,748 entries when we checked on October 20, 2026. The CIS Controls ask even the smallest organization to perform operating system and application updates through automated patch management on a monthly, or more frequent, basis.
So a monthly patch compliance rate is a reasonable thing for a provider to report. It is not a reasonable thing to read on its own. Read it next to three answers. What was counted, which machines are missing, and how long they have been missing.
The missing percentage is almost never random
The missing percentage is the same short list of machines every month. A patch fails for reasons that belong to the asset rather than to the patch, so the same assets fail again next month, and the month after that.
Three reasons cover most of it. The machine needs a restart nobody will authorize. The vendor no longer ships a fix. Or the asset carries no patch agent at all, which is normal for firmware, switches and firewalls.
Restarts are the quiet one. Microsoft built hotpatching for Windows Server specifically to avoid them, and even then a planned year runs four planned baseline releases that require a restart plus eight hotpatch releases that do not. Microsoft's own documentation names what stays outside that program. Non-security updates, .NET updates and non-Windows updates such as drivers and firmware are excluded from hotpatching and still require you to restart the machine. So the server you least want to reboot is the server that still has to reboot.
Line those three reasons up against a real estate and the result is the inverse of a random sample. The machines nobody will reboot are the ones running payroll, the shared drive and the phone system. The devices with no patch agent are the firewall and the switches, which sit directly on your attack surface. A random 13 percent would be mostly laptops. A real 13 percent is mostly business-critical.
A random residual would be mostly laptops. A real residual is mostly the systems you cannot afford to turn off, which is the exact inverse of what the percentage implies.
Attackers worked this out first. Google's threat intelligence team tracked 90 zero-day vulnerabilities exploited in the wild in 2025, and identified 43 of them, or 48 percent, in enterprise software and appliances. About half of those enterprise cases, 21 of 43, sat in security and networking products. Its explanation is blunt. The absence of EDR technology on most edge devices, like routers, switches, and security appliances, can create a blind spot for defenders, making it an ideal attack surface.
CISA's current deadline table makes the same point from the defender's side. Under BOD 26-04 the deadline for a flaw depends on four questions about the asset rather than the severity score: whether the asset is publicly exposed, whether the flaw is in the KEV catalog, whether an adversary can automate the exploit, and whether it grants partial or total control. A CVSS score rates the flaw in isolation. The deadline rates the machine. That is why one CVE can be a three-day job on your firewall and a next-rebuild job on a test box.
Question 1: what is in the denominator?
To answer question one, ask your provider for the asset count behind the percentage, broken out by asset type. Five classes matter. Workstations, servers, network devices, hypervisors (the hosts your virtual servers run on) and firmware. Most monthly reports cover the first class well and the last three barely at all.
The federal standard spells out the same breakdown. BOD 26-04 requires agencies to tag every externally reachable asset with its environment, its exposure as public or internal, and its asset type as server, application, or network device. BOD 23-01 sets the cadence underneath it, requiring automated asset discovery every 7 days and vulnerability enumeration every 14 days across all discovered assets, including roaming devices. A government agency cannot report compliance without that inventory. Neither can your provider, and neither can you read their number without it.
Network gear is the gap that matters most. In February 2026 CISA issued a directive about exactly this, ordering agencies to immediately update every vendor-supported edge device running end-of-support software, including firmware, and to decommission the devices on CISA's end-of-support list within 12 months. The directive's scope names load balancers, firewalls, routers, switches and wireless access points. Ask whether any of those appear in your monthly figure. The honest answer is often that the patch tool cannot see them, so they were excluded from the count.
Vulnerability scanning is the cross-check that keeps the denominator honest. A patch tool reports on agents it installed. A scanner scans the network and finds what the agent never reached. CIS asks organizations to scan externally-exposed assets at least monthly and internal assets at least quarterly, using authenticated and unauthenticated scans. When the two counts disagree, the scanner is usually right, and the difference is your unmeasured attack surface. Our network vulnerability assessment checklist works through that scope question step by step.
Question 2: which machines make up the missing percentage?
To answer question two, ask for the names. A patch compliance rate with no asset list attached cannot be audited, and a provider who really operates the control produces the list in minutes, because the tool already holds it.
Request four columns for every failing asset. The hostname, what the machine does for the business, the missing patch or CVE, and the reason it failed. Reasons cluster fast. A pending restart, a stale agent that stopped reporting, a vendor fix that does not exist, an unsupported operating system, or a change frozen by the business.
Industry-wide figures suggest most organizations never reach this list. Verizon measured a median 43 days to fully patch a known exploited vulnerability, almost two weeks longer than the previous year's 32 days, and found only 26 percent of CISA known exploited vulnerabilities fully remediated, down from 38 percent. Those are flaws confirmed as being used in attacks, and roughly three quarters of them stayed open. The reporting percentage at those same organizations looked fine.
Then do the one comparison that beats every percentage. Put this month's failing list beside the list from three months ago. If seven of the ten names repeat, you do not have a patching backlog. You have a standing exception that nobody wrote down, and a provider who has been reporting it as a rounding error. Ask them to close two of the repeats this quarter and verify the fix landed on the asset, not just in the ticket.
Question 3: how long have those machines been missing?
To answer question three, ask for the age of every open gap in days, not this month's score. A percentage resets every month. An overdue patch does not. Age is the only field that distinguishes a slow week from a two-year decision.
CISA starts its clock the same way. Under BOD 26-04 the remediation timeline begins when CISA adds the vulnerability to the KEV catalog, or when the agency finds it on an asset, whichever event occurs first. The highest-risk combination carries a three-day deadline, and the agency must also carry out a forensic triage of the asset to assess whether the system is compromised. You are not a federal agency. The yardstick still works, because an attacker's timetable does not change with your sector or your headcount.
Ask for the open gaps bucketed by age. Under 30 days, 30 to 90 days, 90 to 365 days, and over a year. The shape tells you more than the total ever will. A fat bucket under 30 days is normal operations. A long tail over a year old is not a backlog at all. It is a set of decisions someone made and never revisited.
Expect your provider to prioritize within that list, and expect them to say how. A CVSS score alone is a weak sort order, because it rates the flaw and ignores the machine. Whether the flaw sits in the KEV catalog and whether the affected asset is internet-facing are the better tests, which is precisely how CISA now tiers its own deadlines. If you want to understand what each kind of security test contributes to that ranking, read our guide to vulnerability assessment vs penetration testing.
The exception register is where someone accepted the risk for you
An exception register is the written list of assets your provider has deliberately left unpatched, with a reason recorded against each one. It is the most important document in patch management and the one buyers almost never ask to see. Every line on it is a risk acceptance, which means somebody accepted that risk on your behalf. Usually not you.
A sound entry carries six fields. The asset, the missing patch or CVE, the reason, the compensating control, a named owner, and an expiry date. Miss the owner and nobody is accountable for closing it. Miss the expiry date and a temporary exception quietly becomes permanent, which is how end-of-life software ends up running a warehouse four years later.
Not patching is a legitimate choice when it is actually a choice. CISA's own directive treats removing the system from the internet as one valid mitigation, and allows a fix-on-system-upgrade timeline for lower-risk combinations, where the fix lands at the next scheduled rebuild. Its KEV requirements go further for products that cannot be fixed at all. Agencies must apply vendor updates, or remove the product from networks if it is end-of-life or otherwise cannot be updated.
End-of-life software is the clearest test of whether your register is real. Support for Windows 10 ended on October 14, 2025, and Microsoft no longer provides software updates, security fixes, or technical assistance to Windows 10 PCs. The consumer Extended Security Updates option runs to October 12, 2027 and excludes devices managed by an organization, so your business machines are not covered by the cheap route. If your estate still runs Windows 10, that is not a patching failure. It is a budget decision, and it belongs in the register with a date against it.
NIST frames the whole activity this way. Its enterprise patch management guide calls patching a critical component of preventive maintenance for computing technologies and a cost of doing business, and notes the familiar split between business owners and technology teams over what patching is worth. The exception register is where that argument gets settled in writing, in advance, instead of during an incident.
What to ask your provider on Tuesday
Send your provider six requests in one email. Each takes minutes to answer if the control is operated, and days if it is not. The delay is the finding.
- Request the asset count behind last month's patch compliance rate, split by workstation, server, network device, hypervisor and firmware.
- Request the named list of every asset that failed, with the reason recorded for each one.
- Request the same failing list from three months ago, so you can see which names repeat.
- Request the age of every open gap in days, bucketed under 30, 30 to 90, 90 to 365 and over a year.
- Request the exception register, with a named owner and an expiry date on every entry.
- Request the remediation SLA in writing, stating the patch window by severity and who signs off a missed one.
Then fix three things in the contract rather than the proposal deck. Name the maintenance window when restarts are allowed, and name who can approve one outside it. State the remediation SLA in days by severity, and require your provider to remediate anything already in the KEV catalog on a faster track. Require a quarterly review of the exception register, where each entry is closed, renewed with a fresh expiry date, or the asset is scheduled to be decommissioned.
The reason to do this is arithmetic rather than fear. IBM put the global average cost of a data breach at US$4.99 million in 2026, a 12 percent increase and a record high. The work above costs you one email and an hour reading the answers. None of it buys perfect security, and no honest provider offers that. It buys a measurable, documented and verified picture of what is actually patched, plus an independent view of which decisions were already made for you. For the layer underneath patching, the settings that stay wrong on a fully patched machine, read our guide to security misconfiguration.
FAQ
What is a good patch compliance rate?
No single percentage is good, because the figure depends on which assets were counted. Judge scope and age instead. Verizon found only 26 percent of known exploited vulnerabilities fully remediated, so a 98 percent score that excludes servers and network devices tells you less than a 90 percent score covering everything.
What does patch compliance rate mean?
A patch compliance rate is the share of available patches installed across the assets in scope, usually reported monthly. It is a fraction, so the denominator sets the number. CIS Controls ask organizations to perform operating system and application updates through automated patch management on a monthly, or more frequent, basis.
How fast should my MSP patch a critical vulnerability?
Three days is the benchmark for the highest-risk case. CISA's directive sets a three-day deadline plus a forensic triage of the asset for a publicly exposed, known-exploited flaw granting total control, with the clock starting when the flaw enters the KEV catalog. Ask for your provider's remediation SLA in days by severity.
What is an exception register in patch management?
An exception register is the documented list of assets left unpatched on purpose, with a reason for each. Every entry records a risk acceptance made on your behalf. A sound entry names the asset, the missing CVE, the compensating control, an owner and an expiry date, and the register gets reviewed quarterly.
Does patch compliance include firewalls and firmware?
Usually not, and that is the main blind spot. Patch tools report on installed agents, which network gear rarely carries. CISA ordered agencies to update every vendor-supported edge device running end-of-support software, including firmware, naming routers, firewalls, switches and wireless access points. Ask whether yours are counted.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on rating and verified data, paid placement is always labelled, and we do not sell IT services. Take these three questions to three merit-ranked firms in your city and compare the answers side by side.