Patch management for businesses: a practical method for SMBs

The short answer: patch management is not “clicking Update now and then”. It is a five-step cycle: know what you own, know what is vulnerable, decide what goes first, deploy in waves and verify it is installed. In an SMB, two rules do most of the work: vulnerabilities already being exploited and internet-facing devices (firewalls, VPN, email, phone system) come before everything else, and workstations update automatically, in rings, with a deadline.

At ALLSAFE SOLUTIONS, a managed IT provider in Casablanca, we run this cycle every month for our clients as part of our business cybersecurity in Morocco offering. This guide draws on NIST SP 800-40 Rev. 4 (Guide to Enterprise Patch Management Planning), Microsoft Learn documentation on Windows Update and Intune, the CISA KEV catalogue and the bulletins of maCERT, Morocco’s national CERT run by the DGSSI.

Why patches remain the first line of defence

Attacks on businesses in Morocco often follow the same pattern: a vulnerability published on an internet-facing device, a patch available, and a company that has not installed it yet. Firewalls, VPN gateways, mail servers, hypervisors: they are prime targets, because a single device gives access to the whole network. Our recent alerts show concrete examples, such as the VMware ESX flaw CVE-2026-41709, exploited before many companies had updated.

NIST puts it simply: patch management is preventive maintenance. It is not decided flaw by flaw in a rush; it is planned, with a schedule, owners and checks. The CIS Controls make it the subject of Control 7, continuous vulnerability management. And an organisation that patches regularly handles the emergency far better on the day a critical flaw drops.

Step 1: the inventory, without which nothing works

You cannot fix what you do not know about. The inventory lists, for each device:

• type and role: workstation, server, firewall, switch, Wi-Fi access point, IP PBX, NAS, printer;
• system and exact version: Windows 11 and its release, Windows Server, FortiOS, Fireware, ESXi, Proxmox VE, NAS firmware;
• installed software on workstations and servers: browsers, office suite, PDF readers, VPN clients, ERP;
• exposure: reachable from the internet or not;
• end-of-support date announced by the vendor;
• owner: who approves and who applies.

In an SMB, the endpoint management tool (Intune, a managed-services RMM console, the antivirus or EDR console) provides most of this for computers. Network equipment, telephony and storage are added by hand, and that is often where things get missed. We cover Windows device management in our guide to Microsoft Intune for SMBs.

Step 2: know what is vulnerable

Four sources complement each other:

Source	What it provides
Vendor advisories (Microsoft Security Response Center, FortiGuard PSIRT, WatchGuard, VMware, Veeam, 3CX…)	Affected products and versions, severity, fixed version, workarounds
CISA KEV catalogue	Vulnerabilities with confirmed exploitation, with a remediation due date for US federal agencies
maCERT bulletins (DGSSI)	Alerts published for Moroccan organisations, often linking to vendor advisories
Vulnerability scanner	What is actually missing on your machines, version by version

Microsoft releases its monthly security updates on the second Tuesday of the month (“Patch Tuesday”), with out-of-band releases for emergencies. Other vendors have their own rhythm, so you must follow their advisories, not just Windows Update. That is the purpose of our Security alerts section, where we summarise each major flaw with the versions to install.

Step 3: prioritise, because you cannot do everything on the same day

Every month brings dozens of patches. Sorting them by CVSS score alone is not enough: many flaws are rated critical without ever being exploited, and some medium-severity flaws are exploited at scale. We combine three criteria:

1. Is the vulnerability exploited? Listed in the CISA KEV catalogue, or marked “exploited” in the vendor advisory. If so, it is an emergency.
2. Is the device exposed to the internet? A firewall, VPN portal, mail system, web server or IP PBX reachable from outside comes before an internal server.
3. What severity did the vendor publish? Critical, high, medium, low.

The EPSS score (Exploit Prediction Scoring System), published by FIRST, estimates the probability that a vulnerability will be exploited in the next 30 days. It helps separate the many “high” flaws.

In practice, this gives four handling levels:

Level	Case	Handling
Emergency	Exploited flaw on an exposed device (firewall, VPN, email)	Patch or workaround immediately, outside the schedule
Priority	Exploited flaw on an internal system, or critical flaw on an exposed device	As soon as possible, with a dedicated maintenance window
Monthly cycle	Routine security updates (Patch Tuesday, browser and software updates)	Usual deployment rings
Planned	Feature updates, new major versions, firmware with no known flaw	After testing, in the quarterly schedule

Step 4: deploy in rings

Workstations

Microsoft recommends deploying in rings: a small test group (often the IT team), a pilot group representative of the business, then the rest of the estate. In Intune, each ring is configured with:

• a quality update deferral of 0 to 30 days;
• a feature update deferral of 0 to 365 days;
• a deadline of 2 to 30 days, after which the update installs automatically;
• a grace period of 0 to 7 days before a forced restart;
• the ability to pause a ring for up to 35 days if a patch causes trouble, and to uninstall the latest quality update.

The deadline is the most important setting: without it, devices whose users never restart stay unpatched for weeks. Windows Autopatch, included in some Microsoft 365 licences, automates these rings. For third-party software (browsers, PDF readers, video-conferencing tools), turn on their automatic updates or push them through the endpoint management tool.

Servers

Servers are not patched like workstations: a restart interrupts the business. The method:

• a fixed maintenance window known to the business (for example a weekday evening after Patch Tuesday);
• a verified backup or a virtual machine snapshot just before;
• the right restart order: domain controllers one at a time, then file servers, then applications;
• a functional test after restart: sign-in, shares, ERP, printing.

Domain controllers come first: we explain why in our Active Directory hardening guide.

Firewalls, hypervisors and network devices

This is often the weak spot, even though these are the most exposed devices. A firewall or hypervisor does not update itself: you read the release notes, check the upgrade path recommended by the vendor, back up the configuration, then schedule a short outage. Our guide to upgrading FortiOS details the method for FortiGate; the principle is the same for WatchGuard Fireware, VMware ESXi, Proxmox VE, NAS units and IP PBXs.

Step 5: verify, and measure

A patch that is “deployed” is not necessarily installed. The monthly check covers:

• the share of up-to-date workstations per ring, and the named list of laggards;
• servers not restarted since the last window;
• the version of each firewall, hypervisor and IP PBX compared with the latest fixed release;
• installation failures and their cause;
• end-of-support systems still in place.

These indicators go into the monthly managed-services report. We present them in our article on IT monitoring KPIs.

Systems you cannot patch

An end-of-support system no longer receives security updates. Windows 10 reached end of support on 14 October 2025; older Windows Server versions, some NAS units, older IP PBXs and older-generation firewalls are in the same situation. For these devices:

• plan the replacement in the budget, starting from the inventory (see our guide on renewing your IT fleet);
• isolate them meanwhile: separate network, no internet access, limited accounts, strict firewall rules;
• monitor them: an EDR and monitoring reduce the risk without removing it.

The mistakes we see most often

1. Patching Windows and forgetting the firewall, the VPN or the hypervisor, which are precisely the targets.
2. Automatic updates with no deadline: devices that do not restart for weeks.
3. No backup before updating a server, so no way back.
4. A server “too sensitive to restart”, which ends up months behind.
5. No end-of-support list, discovered the day a serious flaw is published.
6. No one in charge: everyone thinks someone else is handling it.

Patch management checklist

• Up-to-date inventory: hardware, systems, versions, software, exposure, end-of-support dates.
• Vendor advisories, CISA KEV catalogue and maCERT bulletins followed weekly.
• Written priority rule: exploited flaws and exposed devices first.
• Deployment rings for workstations, with deadline and grace period.
• Monthly maintenance window for servers, with a verified backup beforehand.
• Update procedure for firewalls, hypervisors, NAS units and IP PBXs.
• Monthly compliance check and list of laggards.
• Replacement plan for end-of-support systems.

How we do it

We start with a free initial audit: estate inventory, versions of exposed devices, update status of workstations and servers, end-of-support systems. You receive a list of fixes ranked by risk. Then, as part of our managed IT services in Morocco, we run the cycle every month: Intune rings or RMM console for workstations, maintenance windows for servers, firewall and hypervisor updates, and a compliance report. Our 24/7 monitoring team follows the alerts, and a critical incident is handled in under 15 minutes.

As a Microsoft partner and Fortinet partner, we administer our clients’ Windows, Intune, servers and firewalls every day. Request your free initial audit: we reply within 24 business hours.