Patch management
Also called: patching, updates
In one sentence
Keeping software and devices updated so known security holes get closed before attackers use them.
Patch management is the routine of applying security updates to operating systems, applications, and network gear on a known schedule. Unpatched, internet-facing software is now a leading way attackers get in.
Why it's on your cyber insurance application
Applications ask how fast you apply critical patches and whether you run any end-of-life systems.
What this looks like in practice
A cadence in writing beats a better cadence that lives in someone's head. Something like: security updates on workstations apply automatically within seven days, servers get a monthly window on the second Tuesday, anything rated critical goes in within 72 hours, exceptions get logged with a reason and a date. That paragraph is the answer to the question. Watch the gear nobody thinks of as software: the firewall, the network switch, the printer with a web console. Those run firmware with its own update cycle and they are usually the oldest thing on the network.
How the Readiness Check scores it
The free Check asks the same question a carrier will. Here it is, why it's asked, and the fix if today's honest answer is no. The full application question list has the rest.
Patching & vulnerabilities
How are security updates applied to your systems and software?
Why carriers ask: Unpatched, internet-facing software is now a leading initial-access vector. Applications ask about patch cadence and end-of-life systems specifically.
If the answer is no: Have whoever manages IT produce a list of what's patched automatically vs. manually. That list becomes your patch-management policy's appendix.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
Guides that cover this
Cybersecurity 101: the basic precautions insurers actually notice
A plain-English guide to the cybersecurity basics that move the needle on a cyber insurance application, and which of them you can fix in an afternoon.
The 7 controls every cyber insurance application asks about in 2026
Cyber insurance applications in 2026 ask about seven controls. Here's each one, why carriers ask, and the evidence you need before signing the attestation.
Where this comes up by trade
Some trades get asked about this harder than others, usually because a rule or a claim pattern already points at it. These pages have that detail.
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.