What is application patching?
Where it stops an attack.
- The attack A flaw in a VPN or PDF reader is published, and attackers scan the internet for copies that haven’t been fixed.
- Stopped here The fix was installed inside the deadline, before the scan reached you.
- The result The known way in is already closed.
Essential 8 patching timeframes for applications
What changes at each level.
What changes ML1 Maturity Level 1. ML2 Maturity Level 2. ML3 Maturity Level 3.
Online services 48 hours if critical or exploited, otherwise 2 weeks No change
No change
Office, browsers, email, PDF and security software 2 weeks No change
48 hours if critical or exploited, otherwise 2 weeks
All other applications Not required
1 month No change
Asset discovery and scanning Discovery fortnightly. Scans daily for online services, weekly for common appsAdds fortnightly scans of other apps No change
Unsupported software Remove online services and common apps No change
Remove all unsupported applications
Each level includes everything in the one before. A plain-English summary, not the requirement text. ASD Essential Eight Maturity Model (November 2023)
How to patch applications
Protection first, disruption last.
- 01
Know what you have
An automated software inventory across every device, refreshed at least fortnightly. - 02
Automate the common apps
Browsers, Microsoft 365 apps and PDF readers update themselves, with reports to prove it. - 03
Fast-track internet-facing systems
Firewalls, VPNs and remote access get a 48-hour process for critical or exploited flaws. - 04
Retire unsupported software
If the vendor has stopped patching it, remove or replace it.
Common application patching mistakes
Where rollouts go wrong.
-
Trusting auto-update blindly
Updates fail silently. Without reports you don’t know who is behind.
-
Forgetting the firewall and VPN
They run software too, and attackers scan for them first.
-
Keeping old software “just in case”
Unsupported PDF readers and runtimes are easy targets.
How quickly do we need to patch applications?
At Maturity Level 1, online services get 48 hours for a critical or exploited flaw and two weeks otherwise. Office, browsers, email, PDF and security software get two weeks. At Maturity Level 3, those apps also get 48 hours for critical or exploited flaws.
Does Microsoft 365 patch itself?
Microsoft 365 apps update automatically when configured correctly. You still need reports to prove it, and a plan for everything that isn’t Microsoft.
What counts as an online service?
Anything you run that is reachable from the internet: VPNs, remote desktop gateways, firewall management portals, web servers and client portals.