What is an unpatched system?¶
An unpatched system is a system that has not received one or more available software or security updates.
Avoid the dangerous assumption¶
The dangerous assumption is that being unpatched proves negligence or exploitation.
It does not.
A patch may be unavailable for the specific version, delayed for operational reasons, superseded, incompatible or applied through another mitigation.
Investigators should establish:
- which update was missing
- when it became available
- which vulnerability it addressed
- whether the affected component was enabled and exposed
- what organisational process governed patching
- whether other mitigations existed
- whether exploitation evidence is present.
A missing patch may explain why a vulnerability remained available.
It does not prove that the vulnerability was used.
Likewise, a fully patched system may still be compromised through stolen credentials, configuration weakness, supply-chain compromise or a new vulnerability.
Preserve patch-management records, system version, update logs, maintenance history and relevant risk decisions.
Avoid reducing the investigation to a compliance assessment unless policy or duty is directly relevant.
The operational question is what the missing patch changed about opportunity, detection and response.
Where named products and vulnerabilities are involved, current vendor guidance should be checked.
Patch status can also differ across clustered or replicated systems. One host may be updated while another remains vulnerable, making precise asset identification important before drawing conclusions about exposure.
Record each affected asset separately and avoid organisation-wide assumptions.
This matters when comparing exposure across the environment.
Operational takeaway¶
Use patch status to assess exposure and opportunity, but prove exploitation and responsibility from separate incident and organisational evidence.