Ideally a security patch released by a vendor such as Microsoft for the Windows OS is required to be patched immediately. What would be the recommended patching period that Microsoft or best practices would require by which the systems should be updated? Microsoft as I understand releases patches every second Tuesday of the month as a cycle. Accommodating the time to test those patches against applications within the user environment should 30 days from the date of release for a medium level risk be a reasonable upper limit set for carrying out the patching?

Any suggestions or recommendations are highly appreciated.

  • If a patch is released by Microsoft then it's been deemed stable to their system. However long it takes you to verify stability on your own system should be as long as you wait.
    – RoraΖ
    Commented Jan 8, 2015 at 12:28

2 Answers 2


Microsoft have been telling us for a while that most customers no longer bother to test patches.

The reason is that the cost of testing so many patches so regularly is prohibitive compared to the very low risk of patches causing problems. This is especially true now that patch release cycles are so short since a faulty patch can often itself be patched in less time than it would take for you to test it.

So nearly everyone now just applies Microsoft patches as they arrive - we do that, simply spreading the load of the patches over a few days to even out performance over the network.

The same cannot be said for some other vendor's patches. Java is the obvious one that springs to mind!


We usually apply MS patches about one week after their release (our patch day = third Wednesday of the month vs MS patch day = second Tuesday of the month). This leaves us room to test the patches on non-critical systems before installing them on important systems. These 8 days have proven to be a life saver multiple times in the past because MS had to withdraw multiple updates in the recent months that could've broken your system upon installing. The withdrawal date varied but always happened to be before our patch day took place.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .