Skip to main content

Vulnerability and Patch Management

Vulnerability and Patch Management is the end-to-end process of detecting security weaknesses across your endpoints and systematically deploying fixes. In ServiceOps, these two modules work in sequence: Vulnerability Management surfaces what needs to be fixed, and Patch Management delivers the fix.

The combined workflow closes the loop between detection and remediation inside a single platform. Your security team identifies and prioritizes CVEs through Vulnerability Management, then passes actionable findings to the patch team, who deploys the required patches through Patch Management. Package Management supports this by handling the controlled distribution of software packages across your environment.

  • Vulnerability Management: Continuously detects known CVEs on enrolled Windows endpoints, assigns severity ratings, and tracks exposure by endpoint. This is the starting point of the lifecycle.
  • Patch Management: Deploys software updates to address vulnerabilities and keep systems stable. Patch deployment is the primary remediation action for fixable CVEs surfaced by Vulnerability Management.
  • Package Management: Distributes and installs software packages across endpoints in a controlled and automated manner. Supports onboarding, upgrades, and standardized software environments.

How the Flow Works​

The lifecycle moves in one direction: detect, prioritize, remediate, verify.

  1. Vulnerability Management scans enrolled endpoints against the CVE database and produces a prioritized list of findings ranked by severity and exploit status.
  2. Technicians identify fixable CVEs (Patch Availability = Yes) and pass the impacted endpoint list to the patch team.
  3. Patch Management deploys the required patches to affected endpoints using configured deployment policies.
  4. After deployment, a Scan Now on the endpoint confirms the CVE count has dropped, closing the loop.

Package Management runs alongside this flow for broader software distribution needs, such as deploying new applications or rolling out upgrades that are not driven by a specific CVE.

Key Capabilities & Benefits​

Core Features
  • Automatic CVE Detection: Continuously compares installed software on enrolled Windows endpoints against the Motadata central vulnerability repository without manual scanning.
  • Severity and Exploit-Based Prioritization: Every CVE finding is rated by severity (Critical, High, Medium, Low) and exploit status, so teams focus on the highest-risk issues first.
  • Patch Lifecycle Automation: Automates patch discovery, testing, approval workflows, and deployment across Windows, macOS, and Linux endpoints.
  • Centralized Package Repository: A cloud-based repository is continuously updated with the latest patches and packages from all supported vendors.
  • Scan Now Verification: After patch deployment, an on-demand endpoint scan confirms remediation without waiting for the next scheduled sync.
  • Exportable Audit Logs: All vulnerability database updates and patch deployments are logged and exportable for GDPR, HIPAA, and PCI DSS compliance audits.
Business Benefits
  • Closed-Loop Remediation: Detection and remediation run inside the same platform, eliminating the gap between a security finding and a deployed fix.
  • Reduced Attack Surface: CVEs are identified within 24 hours of a database sync, and fixable ones can be patched in the same cycle.
  • Compliance Readiness: Vulnerability audit logs and patch compliance reports provide evidence packages ready for regulatory audits.
  • Operational Efficiency: Automated scanning, patch deployment, and package distribution free IT teams from manual processes.
  • Standardized Environments: Patch and package management ensures all endpoints run approved, up-to-date software, simplifying support and reducing configuration drift.
Common Use Cases
  • CVE-Driven Patch Cycles: Security team identifies Critical CVEs with Exploit Status = Yes in Vulnerability Management, then patch team deploys fixes in the same sprint using Patch Management.
  • Quarterly Compliance Audits: Enroll all managed servers, run a full scan, export the Vulnerability Audit report, and attach it directly to GDPR or PCI DSS audit packages.
  • New Employee Onboarding: Use Package Management to deploy a standard software kit to new hires while Patch Management keeps those installations current.
  • Rapid Response to Vendor Advisories: When a vendor publishes a critical bulletin, filter the Vulnerabilities list by CVE ID, identify affected endpoints, and deploy the patch immediately.

Getting Started​

  1. Activate licenses: Confirm Vulnerability and Asset (or CMDB) licenses are active under Admin > Account > Licenses.
  2. Assign roles: Give technicians the Vulnerability Manager or Vulnerability Specialist role and the appropriate patch deployment permissions under Admin > Users > Roles.
  3. Configure the vulnerability database: Set a daily sync schedule and notification recipients in Admin > Vulnerability Management > Vulnerability Settings.
  4. Enroll endpoints: Define which Windows computers to monitor in Admin > Vulnerability Management > Endpoints Scope.
  5. Trigger the first scan: Click Update Now in Vulnerability Settings to populate the CVE database and run the initial scan.
  6. Review and prioritize findings: Open the Vulnerabilities list, apply the Critical Vulnerabilities filter, and identify CVEs where Patch Availability = Yes.
  7. Deploy patches: Use Patch Management to create a deployment for the affected endpoints.
  8. Verify remediation: Run Scan Now on patched endpoints and confirm the CVE count has dropped.

Best Practices​

  • Treat Vulnerability Management as the trigger for patch cycles: Rather than scheduling patches on a fixed calendar, use Critical and Exploited CVE filters to drive what gets patched and when.
  • Prioritize by severity and exploit status together: A High-severity CVE with confirmed active exploitation is more urgent than a Critical one with no known exploits in real-world attacks.
  • Test patches before full deployment: Always deploy to a representative test group first to catch compatibility issues before a production rollout.
  • Schedule database syncs and patch deployments outside business hours: Run the daily CVE sync at off-peak times so fresh data is available each morning and patch reboots do not interrupt users.
  • Use the audit log before compliance reviews: Export the Vulnerability Audit and patch compliance reports before an audit request arrives so evidence is already prepared.
  • Asset Management: Vulnerability endpoints and patch targets are drawn from enrolled endpoint assets. Accurate asset inventory ensures complete coverage.
  • CMDB: Vulnerability findings appear on CI detail pages for enrolled Windows computers.
  • Change Management: For high-risk patches on critical servers, integrate patch deployment with the formal change management process for approval and documentation.