--- title: "Patching: The Two Essential Eight Controls That Matter Most | StartCloud" url: https://startcloud.au/learn/essential-eight-patching description: "Module 3 of our free Essential Eight for Australian Business pathway: why ASD puts patch applications and patch operating systems first, what internet-facing changes about urgency, vulnerability scanning, and what to do about software that cannot be patched." lang: en --- Module 3 of StartCloud's Essential Eight for Australian Business learning pathway, in five short units with a knowledge check: why the Australian Signals Directorate lists patch applications and patch operating systems first, why internet-facing systems run on a tighter clock than internal ones, why the timeframes depend on your target maturity level and live in the maturity model appendices, the blind spots that make patching fail (forgotten software, browser extensions, the one odd PC, firmware), and practical options for software and operating systems that can no longer be patched. # Patching: the two that matter most Module 3 · Patching Unit 1 of 5 · about 2 min ## Why these two sit at the top Two of the eight controls are about keeping software up to date. Patch applications, then patch operating systems. The Australian Signals Directorate lists them **first and second**, ahead of multi-factor authentication, ahead of everything else. That order catches people out, because patching is the least interesting thing on the list. There is no product to buy, nothing impressive to show the board, and nobody has ever been thanked for a quiet Tuesday of updates. It is housekeeping, and it sits at the top of Australia's national security baseline anyway. A patch is a repair for a hole that somebody found. The moment the vendor publishes the fix, the hole stops being a secret. Release notes describe what was broken, researchers write it up in detail, and working exploit code often follows within days. The patch closes the door, **and it also announces that the door was ever open**, to everyone, at the same time. The day the patch ships The vendor publishes a fix and a short note about what it fixes. Your business sees an update prompt. Attackers see a description of a weakness, and a list of everyone who has not applied it yet. Both sides got the same email. The weeks after Exploit code gets packaged up and passed around. Scanning tools get taught the new trick. From then on it takes no skill at all to use, which is the part that matters for a business of twelve people in Osborne Park. You are not being singled out. You are being swept up. Patching is a habit, not a project Most businesses do not fail this because they refuse to patch. They fail it because patching is somebody's fifth priority, the update prompt gets postponed on a busy morning, and three months later nobody can say what is running where. The control is not asking for heroics. It is asking for a routine that keeps happening when everyone is flat out, which is a very different problem. StartCloud assistant Online G'day! 👋 I'm the StartCloud assistant. How can I help you today? ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, { "@context": "https://schema.org", "@type": "LearningResource", "name": "Patching: The Two That Matter Most", "description": "Module 3 of the Essential Eight for Australian Business pathway: patch applications and patch operating systems, what internet-facing changes about urgency, vulnerability scanning, and unpatchable or end of life software.", "educationalLevel": "Beginner", "learningResourceType": "Module", "isPartOf": { "@type": "Course", "name": "Essential Eight for Australian Business", "url": "https://startcloud.au/learn/essential-eight-for-australian-business", "provider": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" } }, "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "datePublished": "2026-08-13", "dateModified": "2026-08-13", "url": "https://startcloud.au/learn/essential-eight-patching" } ] ```