Skip to content
Made in the UK

Vulnerability Remediation

What is the difference between patch management and vulnerability remediation?

By , CEO, CybaVerse. Last reviewed

Patch management is the routine process of testing and installing vendor updates. Vulnerability remediation is the wider job of removing a specific weakness, using a patch, a configuration change, a registry fix, a script or removal of unsupported software, and then confirming it has gone. Installing security updates is one tool for remediation, not the whole job.

This page is part of our vulnerability remediation guide.

What is patch management?

Patch management is the planned process of acquiring, testing and deploying software updates across an estate. NIST SP 800-40 describes it as preventive maintenance: a routine, risk-based cycle that keeps operating systems, applications and firmware current with as little disruption as possible to the business.

For most MSPs, patch management runs through an RMM tool on a monthly cycle, with faster deployment for urgent fixes. It is good at the job it is designed for: getting updates onto devices on time.

What is vulnerability remediation?

Vulnerability remediation starts from a finding rather than a release. A scanner reports a specific weakness on specific devices, and the job is to remove it. Sometimes that means a patch, but often it means changing a setting, removing old software or applying a registry fix the vendor has published.

The Cyber Essentials Plus test specification makes this explicit. It defines vulnerability fixes as patches, updates, registry fixes, configuration changes, scripts or any other mechanism prescribed by the vendor. A remediation process is only complete when a rescan shows the weakness has gone.

How do they compare?

The two processes overlap but answer different questions. Patch management asks whether updates are installed. Vulnerability remediation asks whether the weakness is still there. MSPs need both, because each catches what the other misses, and the table below shows where the gaps usually appear for client estates.

QuestionPatch managementVulnerability remediation
Starting pointVendor releaseScanner finding
Main toolRMM or update serviceScanner plus fix
Covers configuration fixesNoYes
Covers unsupported softwareRarelyYes, by removal
Ends whenUpdate is installedRescan shows it has gone

How should MSPs run both together?

Run patch management and vulnerability remediation as one loop, with the scanner as the source of truth. Software updates handles the bulk of routine updates, and remediation picks up whatever the scan still shows. The steps below suit most MSP estates and keep each client inside the Cyber Essentials 14-day window.

  1. Step 1: Keep routine software updates running

    Let your RMM deploy updates on a regular cycle.

  2. Step 2: Scan after every cycle

    Check which vulnerabilities remain after software updates.

  3. Step 3: Triage what is left

    Separate missing updates that failed from issues software updates cannot fix.

  4. Step 4: Apply the right fix

    Use configuration, registry or removal fixes for the remainder.

  5. Step 5: Rescan and record

    Close each item only when a scan confirms it has gone.

Where does CybaOps fit?

CybaOps gives MSPs the scanning and prioritisation side of the loop across every client, and the Remediation Engine can fix security issues automatically, so gaps get closed rather than just reported. Your RMM stays in place for routine patch deployment and change windows.

  • CybaVM gives continuous internal and external vulnerability scanning, prioritised in one place in CybaOps.
  • Vulnerability scanning in CybaOps is powered by Qualys.
  • CybaOps ties vulnerabilities to the assets they affect, so teams fix what matters first.
  • The CybaOps Remediation Engine is live today: it can fix security issues automatically, so gaps get closed rather than just reported.

Updates vs remediation

Updates are one tool. Remediation closes the gap.

Updates are one tool. Remediation closes the gap..

01 Findings from

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Updates vs remediation

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Remediation in
  • CybaVM
  • CybaRemediate

What else do MSPs ask about vulnerability remediation?

These are the questions MSP engineers ask most when they first separate the two processes.

If we patch everything, do we still need remediation?

Yes. Installing security updates does not change insecure settings, remove unsupported software or apply registry fixes. A scan after each patch cycle shows what software updates alone have left behind, and those items need a different fix.

Does Cyber Essentials care about the difference?

Yes. The Cyber Essentials Plus test checks for missing vulnerability fixes of every kind the vendor prescribes, not only patches. A device can be fully patched and still fail on an unfixed configuration issue.

Is traffic-filtering workarounds a form of remediation?

It can reduce risk for a while, but the Cyber Essentials Plus test specification says it is not acceptable long term for legacy unsupported operating systems. Plan to remove or replace that software.

What should you do next?

See CybaOps vulnerability management and the Remediation Engine on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

Related: How do MSPs meet the 14-day remediation rule across every client? and Why do software updates alone not close every vulnerability?

See the Remediation Engine fixing vulnerabilities in a demo.

Book a CybaOps demo