{"id":3169,"date":"2026-02-20T12:09:10","date_gmt":"2026-02-20T12:09:10","guid":{"rendered":"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/missing-patch-detection\/"},"modified":"2026-02-20T12:34:24","modified_gmt":"2026-02-20T12:34:24","slug":"missing-patch-detection","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/missing-patch-detection\/","title":{"rendered":"Missing Patch Detection : How to Find Missing Patches"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p>Even with a <a href=\"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/windows-update-policy\/\">Windows Update Policy<\/a> in place, patches can be missed, devices may be offline during scheduled update windows, users may have postponed restarts, or a policy association may have been skipped for newly enrolled endpoints.<\/p>\n\n\n\n<p>Zecurit&#8217;s <strong>Missing Patch Detection<\/strong> gives you real-time visibility into which devices have not received specific security or feature updates, enabling you to act before vulnerabilities are exploited.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Missing Patch Detection Matters<\/h2>\n\n\n\n<p>According to industry research, the majority of successful cyberattacks exploit known vulnerabilities for which patches already exist. The gap between a patch being released and it being applied to every device in your organization is your window of risk.<\/p>\n\n\n\n<p>Missing Patch Detection closes this gap by:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Continuously scanning enrolled endpoints for absent patches<\/li>\n\n\n\n<li>Categorizing missing patches by severity (Critical, Important, Moderate, Low)<\/li>\n\n\n\n<li>Highlighting devices that are most at risk<\/li>\n\n\n\n<li>Enabling targeted remediation without waiting for the next scheduled update cycle<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Devices must be enrolled in Zecurit and actively checking in.<\/li>\n\n\n\n<li>The Zecurit agent must be installed and running on target endpoints.<\/li>\n\n\n\n<li>Appropriate permissions to view inventory, patch management and reports.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How Missing Patch Detection Works<\/h2>\n\n\n\n<p>When a device checks in with the Zecurit platform, the agent queries the local Windows Update service and reports:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The current patch level of the operating system<\/li>\n\n\n\n<li>A list of available but not-yet-applied updates (by KB article number)<\/li>\n\n\n\n<li>The severity classification of each missing patch (based on <a href=\"https:\/\/msrc.microsoft.com\/\" target=\"_blank\" rel=\"noopener\">Microsoft&#8217;s MSRC data<\/a>)<\/li>\n\n\n\n<li>The date the patch was released and how long it has been pending<\/li>\n<\/ul>\n\n\n\n<p>This data is aggregated in the Zecurit dashboard, giving you a fleet-wide view of patch compliance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1 : Navigate to the Patch Status View<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the left sidebar, click <strong>Patch<\/strong>.<\/li>\n\n\n\n<li>Select the device or device group you want to inspect.<\/li>\n\n\n\n<li>Open the <strong>Patch Views<\/strong><\/li>\n<\/ol>\n\n\n\n<p>You will see a list of all enrolled devices with a summary of their current patch compliance state:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Column<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td>Device Name<\/td><td>Hostname of the endpoint<\/td><\/tr><tr><td>Last Check-in<\/td><td>When the device last communicated with Zecurit<\/td><\/tr><tr><td>Missing Patches<\/td><td>Number of missing patches (by severity)<\/td><\/tr><tr><td>OS Version<\/td><td>Current Windows version and build<\/td><\/tr><tr><td>Compliance Status<\/td><td>Compliant \/ At Risk \/ Critical<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2 : Drill Into a Specific Device<\/h2>\n\n\n\n<p>Click on any device name to open the device detail view. Navigate to the <strong>Missing Patches<\/strong> section to see a full list of patches the device has not yet applied.<\/p>\n\n\n\n<p>For each missing patch, you will see:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>KB Number<\/strong> : the Microsoft Knowledge Base article identifier (e.g., KB5034439)<\/li>\n\n\n\n<li><strong>Title<\/strong> : a short description of what the patch addresses<\/li>\n\n\n\n<li><strong>Severity<\/strong> : Critical, Important, Moderate, or Low<\/li>\n\n\n\n<li><strong>Release Date<\/strong> : when Microsoft released the patch<\/li>\n\n\n\n<li><strong>Days Pending<\/strong> : how long the patch has been available but unapplied<\/li>\n\n\n\n<li><strong>Category<\/strong> : Security Update, Cumulative Update, Feature Update, Driver, etc.<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Use Case:<\/strong> A compliance audit requires you to prove that no device in the Finance department is missing any Critical security patch released in the last 30 days. Drill into the Finance device group, filter by <strong>Severity: Critical<\/strong> and <strong>Days Pending: &gt; 0<\/strong>, and export the results as evidence.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3 : Filter and Sort Missing Patches<\/h2>\n\n\n\n<p>Use the filter options at the top of the Missing Patches view to narrow your focus:<\/p>\n\n\n\n<p><strong>Filter by Severity<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Critical : Patches for vulnerabilities that can be exploited remotely without user interaction. Remediate immediately.<\/li>\n\n\n\n<li>Important : Patches that reduce risk significantly. Remediate within your standard SLA (e.g., 14 days).<\/li>\n\n\n\n<li>Moderate \/ Low : Lower-risk updates. Include in your next scheduled maintenance window.<\/li>\n<\/ul>\n\n\n\n<p><strong>Filter by Category<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security Updates<\/li>\n\n\n\n<li>Cumulative Updates<\/li>\n\n\n\n<li>Feature Updates<\/li>\n\n\n\n<li>Driver Updates<\/li>\n<\/ul>\n\n\n\n<p><strong>Filter by Device Group<\/strong> Quickly isolate missing patches for a specific department or location group.<\/p>\n\n\n\n<p><strong>Sort by Days Pending<\/strong> Sorting by days pending surfaces the oldest unapplied patches \u2014 these represent the highest risk since the vulnerability has been publicly known the longest.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4 : Take Remediation Action<\/h2>\n\n\n\n<p>Once you have identified devices with missing patches, you have several options:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Option A : Force an Immediate Update Check<\/h3>\n\n\n\n<p>Trigger an on-demand update scan and installation on the device:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Select the device(s) from the list.<\/li>\n\n\n\n<li>Click <strong>Remote Actions \u2192 Run Windows Update<\/strong>.<\/li>\n\n\n\n<li>The device will immediately check for and apply pending updates, regardless of the scheduled policy window.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Option B : Update the Windows Update Policy<\/h3>\n\n\n\n<p>If multiple devices in the same group are consistently missing patches, the underlying policy may need adjustment:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Navigate to <strong>Configurations \u2192 Profiles<\/strong> and open the relevant profile.<\/li>\n\n\n\n<li>Review the <strong>Windows Update Policy<\/strong> settings \u2014 check if deferrals are too long or if active hours are preventing restarts.<\/li>\n\n\n\n<li>Adjust settings and re-publish. Changes will take effect at the next check-in.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Option C : Reassign the Profile<\/h3>\n\n\n\n<p>If a device is missing patches because it was never associated with a patch profile:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Groups and Devices<\/strong> and locate the device.<\/li>\n\n\n\n<li>Click <strong>Assign Profile<\/strong> and select the appropriate patch profile.<\/li>\n\n\n\n<li>The policy will be applied at the next check-in.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5 : Generate a Missing Patch Report<\/h2>\n\n\n\n<p>For compliance, auditing, or management reporting:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Navigate to <strong>Reports<\/strong> in the left sidebar.<\/li>\n\n\n\n<li>Select <strong>Patch Compliance<\/strong> or <strong>Missing Patches<\/strong> from the report library.<\/li>\n\n\n\n<li>Configure the report parameters:\n<ul class=\"wp-block-list\">\n<li><strong>Date Range<\/strong> : e.g., last 7 days or last 30 days<\/li>\n\n\n\n<li><strong>Device Group<\/strong> : all devices or a specific group<\/li>\n\n\n\n<li><strong>Severity Filter<\/strong> : all severities or Critical only<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Click <strong>Generate Report<\/strong>.<\/li>\n\n\n\n<li>Export as CSV or PDF for record-keeping.<\/li>\n<\/ol>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Use Case:<\/strong> Your CISO requires a monthly patch compliance report for all 200 endpoints. Schedule the <strong>Patch Compliance<\/strong> report to run automatically on the first of each month and email it directly to your security team.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Understanding Patch Severity Levels<\/h2>\n\n\n\n<p>Zecurit uses Microsoft&#8217;s severity classifications directly:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Severity<\/th><th>Definition<\/th><th>Recommended Action<\/th><\/tr><\/thead><tbody><tr><td><strong>Critical<\/strong><\/td><td>Remote code execution with no user interaction<\/td><td>Remediate within 24\u201348 hours<\/td><\/tr><tr><td><strong>Important<\/strong><\/td><td>Privilege escalation, data exposure, or denial of service<\/td><td>Remediate within 7\u201314 days<\/td><\/tr><tr><td><strong>Moderate<\/strong><\/td><td>Requires unusual conditions or user interaction to exploit<\/td><td>Include in next maintenance window<\/td><\/tr><tr><td><strong>Low<\/strong><\/td><td>Very limited impact or extremely difficult to exploit<\/td><td>Patch at next scheduled opportunity<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Common Reasons Patches Are Missing<\/h2>\n\n\n\n<p>Understanding <em>why<\/em> patches are missing helps you fix the root cause rather than just the symptom.<\/p>\n\n\n\n<p><strong>Device was offline during the update window<\/strong> Laptops used by remote workers may be powered off or disconnected during the scheduled update window. Enable <strong>Power Management for Scheduled Installs<\/strong> in your Windows Update Policy to wake sleeping devices.<\/p>\n\n\n\n<p><strong>User postponed the restart<\/strong> If a patch is downloaded but requires a restart, the user may keep postponing it. Reduce the <strong>Grace Period<\/strong> in your policy or enable a firm <strong>Restart Deadline<\/strong> to enforce the restart within a set number of days.<\/p>\n\n\n\n<p><strong>Device is not associated with a patch profile<\/strong> Newly enrolled devices may not have been assigned a profile yet. Regularly audit <strong>Groups and Devices<\/strong> for any device without an assigned profile.<\/p>\n\n\n\n<p><strong>Deferral period has not elapsed<\/strong> If you have a 7-day or 30-day deferral configured, patches will show as &#8220;available but not yet applied&#8221; during this window. This is expected behavior, not a gap.<\/p>\n\n\n\n<p><strong>WSUS server is unreachable<\/strong> If your update source is a WSUS server and it goes offline or is misconfigured, devices will fail to retrieve updates. Monitor your WSUS server health and review device-level update logs if a device consistently shows missing patches despite being active.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Use Case: Full Walkthrough \u2013 Post-Patch-Tuesday Compliance Check<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Scenario:<\/strong> It is the Wednesday after Microsoft&#8217;s monthly Patch Tuesday. Your IT policy requires that all Critical patches be applied within 48 hours. You need to identify any device that has not yet received this month&#8217;s Critical security updates and force immediate remediation.<\/p>\n<\/blockquote>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Patch<\/strong> \u2192 Select your <code>All-Devices<\/code> group.<\/li>\n\n\n\n<li>Open the <strong>Missing Patches<\/strong> tab.<\/li>\n\n\n\n<li>Filter by <strong>Severity: Critical<\/strong> and <strong>Release Date: Last 7 days<\/strong>.<\/li>\n\n\n\n<li>Review the list : any device shown is non-compliant with your 48-hour SLA.<\/li>\n\n\n\n<li>Select all non-compliant devices.<\/li>\n\n\n\n<li>Click <strong>Remote Actions \u2192 Run Windows Update<\/strong> to trigger immediate patching.<\/li>\n\n\n\n<li>Wait for devices to check in (typically within 15\u201330 minutes for online devices).<\/li>\n\n\n\n<li>Refresh the view : previously listed devices should now show as compliant.<\/li>\n\n\n\n<li>Export the final compliance report from <strong>Reports \u2192 Patch Compliance<\/strong> and archive it.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Related Pages<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/\">Patch Management Overview<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/windows-update-policy\/\">Windows Update Policy \u2013 Policy Creation &amp; Association<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/zecurit.com\/endpoint-management\/patch-management\/\">Zecurit Patch Management Product Page<\/a><\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"featured_media":0,"parent":3147,"menu_order":1,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-3169","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/comments?post=3169"}],"version-history":[{"count":1,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3169\/revisions"}],"predecessor-version":[{"id":3172,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3169\/revisions\/3172"}],"up":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3147"}],"prev":[{"title":"Windows Update Policy \u2013 Policy Creation & Association","link":"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/windows-update-policy\/","href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3168"}],"wp:attachment":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/media?parent=3169"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/doc_tag?post=3169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}