Patch management is the process of identifying, prioritizing, testing, and deploying software updates to fix known security vulnerabilities. For Indian SMBs, unpatched software is the single most preventable breach vector: attackers routinely scan the internet for systems running vulnerable versions and exploit them within days of a public CVE disclosure. A structured patch management program — even a lightweight one — dramatically reduces your attack surface, supports compliance under India's IT Act and the DPDP Act 2023, and keeps your business running.
Why Unpatched Software Keeps Breaching Indian Businesses
Every CVE represents a documented weakness with a known fix. Once published, security researchers, defenders, and attackers all have the same information. The race begins: can you patch faster than an attacker can weaponize the finding?
For most Indian SMBs, the answer has historically been no — no dedicated IT staff, fear of breaking production systems, unclear patch ownership, or the assumption that "we're too small to be targeted." None of these hold up against automated exploitation infrastructure that scans millions of IP addresses daily.
The CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) tracks CVEs actively exploited in the wild. Its entries include software in every Indian office: Windows, Apache, Cisco, VMware. These are not edge cases.
The Patch Management Lifecycle
A repeatable patch management process removes the guesswork. Here is the end-to-end lifecycle every Indian SMB should implement, scaled to available resources.
Is affected software in environment?] B -->|No| C[Log and Close
Document decision] B -->|Yes| D[Assess Severity
CVSS Score + EPSS + KEV Status] D --> E{SLA Decision
Critical High Medium Low} E -->|Critical - 24h| F[Emergency Patch
Deploy to prod directly] E -->|High - 7 days| G[Test in Staging
Deploy within SLA] E -->|Medium - 30 days| G E -->|Low - 90 days| H[Schedule Next Maintenance Window] F --> I[Verify Patch Applied
Rescan or version check] G --> I H --> G I -->|Pass| J[Close Ticket
Update CMDB] I -->|Fail| K[Escalate
Apply Workaround or Mitigation] K --> G style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style C fill:#1e3d2f,stroke:#10B981,color:#e2e8f0 style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style E fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style G fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style H fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style I fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style J fill:#1e3d2f,stroke:#10B981,color:#e2e8f0 style K fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
Step 1: Maintain a Software Inventory
You cannot patch what you do not know exists. A current asset inventory — servers, endpoints, network devices, cloud instances, SaaS integrations — is the non-negotiable foundation. For most SMBs, a spreadsheet updated monthly is enough to start; graduate to a CMDB as you grow.
Track: software name, version, vendor, end-of-life (EOL) date, internet-exposed (yes/no), and the responsible owner.
Step 2: Prioritize Using CVSS, EPSS, and KEV Status
Not all CVEs are equal. CVSS scores from NIST (https://nvd.nist.gov/) rate technical severity from 0 to 10. But a CVSS 9.8 in software you do not run is irrelevant, while a CVSS 6.5 in your internet-facing payment gateway may be your top actual risk.
Two additional signals sharpen prioritization:
EPSS (Exploit Prediction Scoring System): Published by FIRST (https://www.first.org/epss/), EPSS estimates the probability a CVE will be exploited within 30 days. EPSS 0.92 means act immediately; EPSS 0.01 can wait for the next maintenance window.
CISA KEV Status: A CVE in the CISA KEV catalog means real attackers are exploiting it now. This overrides all other signals — treat any KEV entry as an emergency regardless of CVSS score.
Step 3: Define and Enforce Patch SLAs
A patch SLA (Service Level Agreement) is a commitment: "we will apply patches of this severity within this many days." Without a written SLA, patches drift indefinitely. With one, you have a measurable standard and an audit trail for compliance conversations.
| Severity | CVSS Range | EPSS / KEV Trigger | Patch SLA | Action |
|---|---|---|---|---|
| Critical | 9.0–10.0 | KEV listed or EPSS > 0.8 | 24 hours | Emergency deployment, may skip full staging cycle |
| High | 7.0–8.9 | EPSS > 0.3 | 7 days | Test in staging, deploy within SLA |
| Medium | 4.0–6.9 | Standard queue | 30 days | Next scheduled maintenance window |
| Low | 0.1–3.9 | Low EPSS | 90 days | Bundle with quarterly updates |
| Informational | — | — | Best effort | Document, review quarterly |
Step 4: Test Before Deploying to Production
For Critical/emergency patches, the risk of NOT patching exceeds the risk of skipping the test cycle. For everything else, a staging environment is worth the effort. Testing catches:
- Patches that break application dependencies
- Vendor patches that introduce new bugs
- Configuration drift that amplifies the patch's footprint
Step 5: Deploy and Verify
Deployment without verification is checkbox compliance theater. Actively confirm the patched version is running — re-run your vulnerability scanner, check the installed version via CLI, or use endpoint telemetry. For any Critical or High patch, verification is mandatory before closing the ticket.
Handling Legacy and EOL Systems
End-of-life (EOL) software — older Windows Server versions, outdated PHP, aging CMS installations — is common in Indian SMBs that built infrastructure years ago and have not had budget to modernize. EOL systems cannot be patched because vendors no longer release security updates.
For EOL systems:
- Document them explicitly as EOL with risk accepted in writing.
- Isolate them from internet exposure using network segmentation.
- Apply compensating controls: WAF, host-based intrusion detection, enhanced logging.
- Plan and fund migration — treating EOL as permanent converts manageable debt into a breach waiting to happen.
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanCVE Patching and CERT-In Compliance for Indian SMBs
India's CERT-In (Computer Emergency Response Team — India) issues advisories on actively exploited vulnerabilities affecting commonly used products. These advisories are publicly available and represent an authoritative signal for Indian organizations about which CVEs carry the highest domestic risk.
Beyond advisories, Indian SMBs handling personal data are subject to the DPDP Act 2023. The obligation to implement "reasonable security safeguards" is active — timely patching is universally recognized as a baseline control. Falling behind on known, patchable CVEs is difficult to defend if a breach triggers enforcement. The IT Act 2000 similarly holds organizations liable for inadequate security practices.
A free VAPT scan gives you a structured starting point: a current view of which CVEs affect your internet-facing assets, prioritized by severity.
Building a Lightweight Patch Program for Resource-Constrained SMBs
Most Indian SMBs do not have a dedicated security team. The program below is designed for a single person managing IT for a 10–200 person organization.
Weekly (30 minutes):
- Review CISA KEV additions from the past week
- Check CERT-In advisories at cert-in.org.in
- Cross-reference against your software inventory
- Patch or schedule any Critical/High findings
- Run a vulnerability scan against internet-facing assets
- Apply all Medium-severity patches
- Update your asset inventory for any new software introduced
- Document any patches deferred and the business reason
- Review Low-severity and informational findings
- Audit EOL software status and migration progress
- Update patch SLA policy if risk posture has changed
- Produce a brief patch compliance report for management
Bachao.AI, built by Dhisattva AI Pvt Ltd, automates the vulnerability discovery layer — running continuous scans against your internet-facing assets and mapping findings to CVSS scores and remediation guidance, so your team spends time patching rather than manually tracking exposures. Browse the Bachao.AI blog for more guides on building security programs for Indian organizations.
The Cost of Inaction
Deferring patches is not a neutral decision — it is an active choice to accept increasing risk. The longer a known vulnerability goes unpatched, the more likely it is that exploit code becomes publicly available, enters commodity attack kits, and is used against your system before you act.
The IBM Cost of a Data Breach 2024 report put the global average breach cost at $4.88 million. Indian SMBs face lower absolute numbers but proportionally devastating impacts: lost contracts, regulatory exposure under the DPDP Act, and the reputational damage of a public breach far outweigh the cost of a patch management program.
Time-to-patch is measurable, and regulators, insurers, and enterprise customers increasingly ask for it. A documented patch program is among the highest-ROI security investments available.