{"id":3147,"date":"2026-02-20T10:50:06","date_gmt":"2026-02-20T10:50:06","guid":{"rendered":"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/"},"modified":"2026-02-20T12:39:55","modified_gmt":"2026-02-20T12:39:55","slug":"patch-management","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/","title":{"rendered":"Patch Management"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

Zecurit’s Patch Management<\/strong> <\/a>module helps IT administrators automate, control, and audit the patching lifecycle for all managed Windows endpoints, from a single device to thousands across multiple locations.<\/p>\n\n\n\n

Without a centralized patch strategy, organizations are exposed to known vulnerabilities that attackers actively exploit. Zecurit eliminates this gap by giving you full visibility into which devices are missing critical updates, and the tools to enforce consistent patching policies at scale.<\/p>\n\n\n\n

What You Can Do with Patch Management<\/h2>\n\n\n\n
Capability<\/th>Description<\/th><\/tr><\/thead>
Windows Update Policy<\/td>Create and deploy granular Windows Update configurations to device groups<\/td><\/tr>
Missing Patch Detection<\/td>Scan endpoints and identify missing security and feature updates<\/td><\/tr>
Deferral Controls<\/td>Defer quality and feature updates to control rollout timing<\/td><\/tr>
Active Hours Management<\/td>Prevent forced restarts during business hours<\/td><\/tr>
WSUS Integration<\/td>Route update traffic through an internal WSUS server<\/td><\/tr>
Compliance Reporting<\/td>Track patch status across all managed endpoints<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Key Concepts<\/h2>\n\n\n\n

Profiles<\/h3>\n\n\n\n

A Profile<\/strong> is a collection of configuration policies (including Windows Update Policy) that you define once and apply to one or more device groups or individual devices. All policies within a profile are automatically enforced on the next device check-in.<\/p>\n\n\n\n

Device Groups<\/h3>\n\n\n\n

You can organize endpoints into Groups<\/strong> (e.g., by department, location, or risk level) and assign different patch profiles to each group. For example, your IT team may receive patches immediately while other departments get a 7-day deferral window.<\/p>\n\n\n\n

Policy vs. Detection<\/h3>\n\n\n\n