What is operating system patching?
Where it stops an attack.
- The attack An attacker uses a Windows or firewall flaw to take full control of a device.
- Stopped here The update was applied on schedule, and unsupported versions were replaced.
- The result The foothold goes no further.
Essential 8 patching timeframes for operating systems
What changes at each level.
What changes ML1 Maturity Level 1. ML2 Maturity Level 2. ML3 Maturity Level 3.
Internet-facing servers and network devices 48 hours if critical or exploited, otherwise 2 weeks No change
No change
Workstations, internal servers and network devices 1 month No change
48 hours if critical or exploited, otherwise 1 month
Drivers and firmware Not required
Not required
48 hours if critical or exploited, otherwise 1 month
Asset discovery and scanning Discovery fortnightly. Scans daily for internet-facing, fortnightly for the rest No change
Adds fortnightly scans of drivers and firmware
Operating system versions Unsupported versions replaced No change
Latest or previous release only
Each level includes everything in the one before. A plain-English summary, not the requirement text. ASD Essential Eight Maturity Model (November 2023)
How to patch operating systems
Protection first, disruption last.
- 01
Inventory every operating system
Laptops, desktops, servers, virtual machines, firewalls, switches and access points. - 02
Automate workstation updates
Update rings in Intune: a pilot group first, then everyone, with restart deadlines. - 03
Schedule server and network patching
A regular maintenance window, plus an emergency process for exploited flaws. - 04
Plan replacements early
Track end-of-support dates and replace systems before they lapse.
Common operating system patching mistakes
Where rollouts go wrong.
-
Restarts postponed forever
Most updates don’t apply until the device restarts.
-
Ignoring firewall firmware
Firewalls and VPN appliances are among the most attacked systems.
-
The old server that “still works”
Unsupported servers are a standing risk, and an insurance problem.
How often should we patch Windows?
Microsoft releases security updates monthly. At Maturity Level 1, workstations and internal servers need them within a month. Internet-facing systems need them within two weeks, or 48 hours if a flaw is critical or exploited.
Are Windows 10 devices still compliant?
Windows 10 reached end of support in October 2025. Unsupported operating systems need replacing, with Extended Security Updates only as a short-term bridge.
Does this apply to Macs?
Yes. The control covers every operating system you run, including macOS.