Module 3 of StartCloud's Essential Eight for Australian Business learning pathway, in five short units with a knowledge check: why the Australian Signals Directorate lists patch applications and patch operating systems first, why internet-facing systems run on a tighter clock than internal ones, why the timeframes depend on your target maturity level and live in the maturity model appendices, the blind spots that make patching fail (forgotten software, browser extensions, the one odd PC, firmware), and honest options for software and operating systems that can no longer be patched.
Patching: The Two That Matter Most
Why these two sit at the top
Two of the eight controls are about keeping software up to date. Patch applications, then patch operating systems. The Australian Signals Directorate lists them first and second, ahead of multi-factor authentication, ahead of everything else.
That order catches people out, because patching is the least interesting thing on the list. There is no product to buy, nothing impressive to show the board, and nobody has ever been thanked for a quiet Tuesday of updates. It is housekeeping, and it sits at the top of Australia's national security baseline anyway.
Here is why. A patch is a repair for a hole that somebody found. The moment the vendor publishes the fix, the hole stops being a secret. Release notes describe what was broken, researchers write it up in detail, and working exploit code often follows within days. The patch closes the door, and it also announces that the door was ever open, to everyone, at the same time.
The vendor publishes a fix and a short note about what it fixes. Your business sees an update prompt. Attackers see a description of a weakness, and a list of everyone who has not applied it yet. Both sides got the same email.
Exploit code gets packaged up and passed around. Scanning tools get taught the new trick. From then on it takes no skill at all to use, which is the part that matters for a business of twelve people in Osborne Park. You are not being singled out. You are being swept up.
Most businesses do not fail this because they refuse to patch. They fail it because patching is somebody's fifth priority, the update prompt gets postponed on a busy morning, and three months later nobody can say what is running where. The control is not asking for heroics. It is asking for a routine that keeps happening when everyone is flat out, which is a very different problem.