OT Patch Management: Why "Just Patch It" Fails, and What Works Instead

In IT, the advice is simple: patch quickly, patch everything. In operational technology (OT), following that advice can do more damage than the vulnerability it fixes. A reboot at the wrong time stops a line. An untested update breaks a control application. A patch the vendor has not approved can void support for the whole system.

That does not mean OT systems should stay unpatched. It means patching needs its own process.

Why OT patching is different

• Uptime is the product. Many processes run around the clock and only stop for planned outages, sometimes once a year or less.
• Vendors qualify the stack. Control system vendors test their applications on specific operating system and patch levels. Installing something they have not approved can break the application and their support.
• Old systems are common. Equipment runs for decades, and many sites still operate systems whose operating systems no longer receive updates at all.
• Testing needs a test bed. Few sites have a representative copy of their control system to try patches on first.
• The network may be isolated. Systems that cannot reach the internet still need updates, antivirus signatures and vulnerability data delivered to them safely.

A practical OT patch process

1. Start from the inventory

You need to know the exact operating system, firmware and software versions on every asset. Without an accurate asset inventory, patch management is guesswork.

2. Work out which vulnerabilities apply

Match installed versions against published vulnerabilities and vendor advisories. Then prioritize by real risk, not severity score alone: is the vulnerability exploitable, is the system reachable, how critical is it? Our guide to OT vulnerability management covers this step in detail.

3. Check vendor approval

For each relevant patch, check whether the control system vendor has qualified it for your version. Most major vendors publish lists of approved security updates for their platforms.

4. Test

Apply the patch to a test system, a spare or the least critical redundant node first. Confirm the control application, communications and redundancy still behave as expected.

5. Schedule

Plan deployment around maintenance windows, turnarounds and redundant switchovers. Critical patches for exposed systems may justify a dedicated window; others can wait for the next planned outage.

6. Deliver safely

Bring patches into the control network through a controlled, auditable path, not by connecting each system to the internet or carrying unchecked USB drives between machines. Verify the integrity of every package before it is used.

7. Verify and record

After deployment, confirm the patch is installed and the system is healthy, and update the inventory. Auditors and frameworks such as NERC CIP expect evidence that patches were evaluated and applied, or that a mitigation plan is in place.

When you cannot patch: compensating controls

Some vulnerabilities will stay open for months, and some systems will never be patched. Compensating controls reduce the risk in the meantime:

• Harden the configuration. Remove unused services and accounts, close unneeded ports and enforce secure settings against a benchmark.
• Restrict network access. Allow only the connections the process needs, from the systems that need them. See the Purdue model explained for how to segment.
• Control remote access. Make vulnerable systems unreachable from outside the zone except through an approved, recorded path.
• Allowlist applications. On fixed-function systems, only allow known software to run.
• Monitor more closely. Watch vulnerable systems for unexpected changes and connections.
• Plan the replacement. Track end-of-support systems in the lifecycle plan, so they are replaced on purpose rather than in a crisis.

Antivirus and signature updates

Antivirus on OT endpoints is only as good as its signatures. Isolated networks need a reliable way to receive them, along with vulnerability data and hardening benchmarks, on a schedule, without opening the control network to the internet. The same delivery path that brings patches in can carry these updates.

How Novaigu helps

Mission Guard records every endpoint’s installed patch updates alongside its hardware, operating system and antivirus, finds the vulnerable software across your sites and benchmarks configurations so hardening can stand in where patching cannot yet. UDR distributes patches, antivirus, vulnerability (CVE), benchmarking and hardening updates to one site or many over private, encrypted, one-way links, with a lockdown mode that switches remote access off entirely. Our engineering services can run patch campaigns during your maintenance windows.