Patch Management

Why it matters for underwriting

Unpatched, publicly known vulnerabilities remain one of the most common and most easily automated exploitation paths for ransomware groups and opportunistic attackers, since scanning the internet for a specific known-vulnerable software version requires no custom malware development. Patch management therefore functions as both a frequency and an accumulation driver: slow patching widens the window during which any individual insured can be compromised, while a shared unpatched software component across many policyholders can trigger correlated losses from a single mass-exploitation campaign. Underwriters use the declared patch cadence, particularly for internet-facing systems and critical severity vulnerabilities, as a proxy for the overall maturity of the insured’s IT operations and as an input into both individual pricing and portfolio-level accumulation modelling.

Capturing the attribute and evidence

Proposal forms typically ask whether a documented patch management process exists, what target timeframe applies for critical and high-severity patches, and whether that timeframe is tightened for internet-facing infrastructure compared with internal systems. Underwriters request the written patch management policy, recent vulnerability scan results or a patch compliance dashboard export showing the actual state of the estate, and an inventory of any systems still running on end-of-life or otherwise unsupported software, since such systems can no longer receive security patches regardless of process quality. Larger or higher-hazard accounts may be asked to provide evidence of a specific recent critical vulnerability, such as a widely publicised zero-day, being remediated within the insured’s own stated timeframe.

Effect on coverage, premium and conditions

A documented, consistently applied patch process with short remediation windows for internet-facing and critical systems supports standard terms and favourable pricing. Slower or inconsistent patching, particularly where internet-facing systems are not prioritised, typically leads to a premium loading, a condition requiring remediation of specifically identified vulnerabilities within an agreed period, or exclusion of losses traceable to a vulnerability that had been unpatched beyond the insured’s own stated target timeframe. A material presence of end-of-life or unsupported systems that can no longer be patched is a frequent basis for declinature or, where accepted, a specific exclusion for losses originating from those systems.

Mitigation measures

A structured vulnerability management programme is recommended, combining regular automated vulnerability scanning with a risk-based prioritisation that patches internet-facing and critical-severity vulnerabilities fastest, supported by an emergency process for out-of-cycle patching when actively exploited vulnerabilities are disclosed. Maintaining an accurate, continuously updated asset inventory is a prerequisite, since systems that are not known cannot be patched. Where legacy or end-of-life systems cannot be retired immediately, isolating them through network segmentation and restricting their network exposure is recommended as a compensating control until replacement or upgrade is completed.