--- title: "Patching: The Two Essential Eight Controls That Matter Most | StartCloud" description: "Module 3 of our free Essential Eight for Australian Business pathway: why ASD puts patch applications and patch operating systems first, what internet-facing changes about urgency, vulnerability scanning, and what to do about software that cannot be patched." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, { "@context": "https://schema.org", "@type": "LearningResource", "name": "Patching: The Two That Matter Most", "description": "Module 3 of the Essential Eight for Australian Business pathway: patch applications and patch operating systems, what internet-facing changes about urgency, vulnerability scanning, and unpatchable or end of life software.", "educationalLevel": "Beginner", "learningResourceType": "Module", "isPartOf": { "@type": "Course", "name": "Essential Eight for Australian Business", "url": "https://startcloud.au/learn/essential-eight-for-australian-business", "provider": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" } }, "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "datePublished": "2026-08-13", "dateModified": "2026-08-13", "url": "https://startcloud.au/learn/essential-eight-patching" } ] --- [![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth")](/ "StartCloud | Managed IT Services Perth") - Cybersecurity - AI Solutions - Cloud - Technology - Networking - Explore [Contact Us](/contact "Contact StartCloud, Perth IT Support") Open menu Module 3 of StartCloud's Essential Eight for Australian Business learning pathway, in five short units with a knowledge check: why the Australian Signals Directorate lists patch applications and patch operating systems first, why internet-facing systems run on a tighter clock than internal ones, why the timeframes depend on your target maturity level and live in the maturity model appendices, the blind spots that make patching fail (forgotten software, browser extensions, the one odd PC, firmware), and honest options for software and operating systems that can no longer be patched. Course contents [Pathway overview](/learn/essential-eight-for-australian-business) Pathway Essential Eight for Australian Business 0 of 5 units done in this module 1. [What it is, and who's asking ](/learn/what-is-the-essential-eight) 2. [Maturity levels ](/learn/essential-eight-maturity-levels) 3. Patching 1. Why these two sit at the top 2 min 2. Internet-facing changes the urgency 2 min 3. You cannot patch what you cannot see 2 min 4. The software you cannot patch 1 min 5. Knowledge check 2 min 4. [Access and privilege ](/learn/essential-eight-access-controls) 5. [What can run ](/learn/essential-eight-application-control) 6. [Backups ](/learn/essential-eight-backups) 7. [Where to start ](/learn/essential-eight-where-to-start) 8. [Proving it ](/learn/essential-eight-proving-it) # Patching: The Two That Matter Most Module 3 · Patching Unit 1 of 5 · about 2 min ## Why these two sit at the top Two of the eight controls are about keeping software up to date. Patch applications, then patch operating systems. The Australian Signals Directorate lists them **first and second**, ahead of multi-factor authentication, ahead of everything else. That order catches people out, because patching is the least interesting thing on the list. There is no product to buy, nothing impressive to show the board, and nobody has ever been thanked for a quiet Tuesday of updates. It is housekeeping, and it sits at the top of Australia's national security baseline anyway. Here is why. A patch is a repair for a hole that somebody found. The moment the vendor publishes the fix, the hole stops being a secret. Release notes describe what was broken, researchers write it up in detail, and working exploit code often follows within days. The patch closes the door, **and it also announces that the door was ever open**, to everyone, at the same time. The day the patch ships The vendor publishes a fix and a short note about what it fixes. Your business sees an update prompt. Attackers see a description of a weakness, and a list of everyone who has not applied it yet. Both sides got the same email. The weeks after Exploit code gets packaged up and passed around. Scanning tools get taught the new trick. From then on it takes no skill at all to use, which is the part that matters for a business of twelve people in Osborne Park. You are not being singled out. You are being swept up. Patching is a habit, not a project Most businesses do not fail this because they refuse to patch. They fail it because patching is somebody's fifth priority, the update prompt gets postponed on a busy morning, and three months later nobody can say what is running where. The control is not asking for heroics. It is asking for a routine that keeps happening when everyone is flat out, which is a very different problem. Mark done and continue ![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth") Cybersecurity-led IT for Australian businesses. We manage security, compliance, and modern IT environments, so risk is governed, not guessed. Ground Floor West, 6 Gibberd Road, Balcatta WA 6021 [08 6285 0001](tel:+61862850001 "Call StartCloud on 08 6285 0001") Serving Perth businesses from Balcatta, Western Australia. ![Microsoft Solutions Partner - Modern Work](/assets/microsoft-solutions-partner-DqvNMv91.png "Microsoft Solutions Partner: Modern Work") ### Services - [Cybersecurity](/cybersecurity "Cybersecurity Services Perth | StartCloud") - [AI Solutions](/ai "AI & Automation Services Perth | StartCloud") - [Cloud](/cloud "Cloud Services Perth | StartCloud") - [Technology](/technology "IT Services and Support | StartCloud") - [Networking](/networking "Business Networking Perth | StartCloud") - [Packages](/packages "IT Support Packages Perth | StartCloud") ### Company - [About](/about "About StartCloud, Perth IT Support Team") - [Company Facts](/facts "StartCloud Company Facts | Perth Cybersecurity-First AI MSP") - [Resources](/resources "IT Resources & Guides | StartCloud Perth") - [Service Areas](/it-support-perth "IT Support Perth | StartCloud") - [Contact](/contact "Contact StartCloud, Perth IT Support") ### Locations - [All Service Areas](/locations "Perth IT Support Areas | StartCloud") - [IT Support Perth](/it-support-perth "IT Support Perth | StartCloud") - [Cybersecurity Perth](/cybersecurity-perth "Cybersecurity Perth | StartCloud") - [MSP Perth](/managed-service-provider-perth "Managed Service Provider Perth | StartCloud") - [Industries We Serve](/industries "IT Support by Industry Perth | StartCloud") © 2026 Start Technologies Pty Ltd trading as StartCloud. All rights reserved. ABN 17 676 121 449 [](https://www.linkedin.com/company/startcloudau "StartCloud on LinkedIn")[](https://www.facebook.com/startcloudaus/ "StartCloud on Facebook")[](https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj "StartCloud on Google") [Terms of Service](/terms-of-service "Terms of Service | StartCloud")| [Privacy Policy](/privacy-policy "Privacy Policy | StartCloud")| [Modern Slavery Policy](/modern-slavery-policy "Modern Slavery Policy | StartCloud")| [Cookie Policy](/cookie-policy "Cookie Policy | StartCloud") StartCloud Assistant Online G'day! 👋 I'm the StartCloud Assistant. How can I help you today? Tell me about your servicesBook a discovery callI need IT support Find Your Solution