Most patch reports I review look reassuring. Coverage sits at 96, 97, or 98 percent. The chart is green. Leadership hears that updates are handled, and the meeting moves on to the next item.
The remaining machines are where the work is. In a company with 200 computers and servers, 2 percent is four systems. One of those systems is often a server, a shared workstation, or a laptop that has been offline during every scheduled update window for months.
What the percentage hides
A coverage number averages everything together. It treats a reception workstation with the same weight as the server that runs accounting, file shares, or remote access.
It also hides age. A machine that missed one update cycle last week carries a different level of risk than a machine that missed twelve cycles in a row. The report shows both as unpatched. The second machine needs attention first.
Common reasons show up in almost every review. A laptop was closed during the update window. A server requires a manual restart that nobody scheduled. An update failed, the system rolled it back, and nobody followed up. A piece of line of business software pins the machine to an older version because the vendor has not approved the newer one.
Each reason has a fix. The fix starts with a list that names the machine, the owner, the missing updates, and how long they have been missing.
Sort the exceptions, do not just count them
Pull the exception list and sort it into four groups.
The first group is internet facing systems: firewalls, remote access servers, VPN gateways, and any server that outside users can reach. Missing updates on these systems get the shortest deadline, measured in days.
The second group is identity and file systems: domain controllers, file servers, and the machines that hold shared company data. These systems support daily work for the whole company, so a failure or a compromise spreads quickly.
The third group is ordinary workstations that are online and in regular use. These belong on the normal update schedule, with a follow up check to confirm the update installed and the machine restarted.
The fourth group is blocked systems. A vendor restriction, a broken update agent, or a hardware fault is preventing the update. Blocked systems need a written reason, a named owner, and a review date. A block without a review date tends to stay in place for a year.
Verify the install, not the push
Many tools report that an update was pushed or scheduled. That status tells you the tool sent the update. It does not confirm the update installed, that it survived a restart, or that the machine is now running the expected version.
Close the loop with a version check. Pick a sample from each group every month and compare the running version on the machine to the version the report claims. Include at least one server and at least one machine that appeared on the previous exception list.
When a mismatch turns up, treat it as a process problem. Find out where the record and the machine parted ways. The usual points are a failed restart, a stalled update agent, or a machine that was rebuilt or renamed and now appears twice in the inventory.
Put dates on the work
A workable standard for a $10M to $30M company is simple to state and simple to audit.
Critical updates on internet facing systems install within seven days of release, or the system gets a written exception with a review date inside that same window. Updates on servers and shared systems install within thirty days. Workstation updates install within thirty days, with automatic restarts scheduled outside working hours.
Every exception carries three fields: the reason, the person who accepted it, and the date it will be reviewed again. Leadership does not need to review every machine. Leadership does need to see the exception count, the oldest exception, and whether that count went up or down since last month.
That short report takes ten minutes to read. It tells you more than a single coverage percentage, because it shows where the remaining risk sits, who owns it, and when it will be checked again.
Start with this month's exception list. Name the machines. Sort them. Set the dates. The percentage will take care of itself once the exceptions have owners.
Not sure where your IT really stands? Start with a Clarity Audit: a focused assessment of your backups, security, vendors, and AI readiness. It's the first step in every engagement I take on.
About the author: Chris McGlasson is a fractional CIO and the founder of ClearStack Advisory, where he helps mid-market companies build AI governance, IT strategy, and technology roadmaps without the overhead of a full-time CIO. He previously built and sold LANPRO Systems, an IT services firm serving 350+ enterprise clients.