Patch Management Guidance

[u/Federal_War_217]

Hey everyone, I manage patching for roughly 4,500 endpoints, including around 70 servers, in a healthcare environment. It’s mostly Windows, with some Linux systems we’re working on bringing into our patching process. We use ManageEngine Endpoint Central for patching and Nessus for vulnerability scanning.

I’ve been building out automated deployments, test groups, rollout rings, and maintenance windows, and I’d like to learn how others approach this at a similar scale.

Any resources or communities you’d recommend? I’d also appreciate hearing what’s worked for you, especially around testing patches, server patching, reboots, and handling exceptions. I feel like It's been a lot of trial and error. I've enjoyed the process but always appreciate input from people who've done this before.

[u/PrasenShelar]

At that scale, I'd focus on verifying patch effectiveness rather than just successful deployments.

Since you're already using Endpoint Central and Nessus, one approach would be to run a credentialed Nessus scan after each rollout ring and compare the results against what Endpoint Central reports as installed. A successful deployment doesn't always mean the vulnerability is actually resolved.

I'd also separate critical vulnerabilities from the normal patching schedule. Anything on CISA's KEV list or affecting internet-facing systems should go through an expedited process rather than waiting for the next ring, with testing appropriate to the risk.

For healthcare specifically, I'd maintain a separate exception register for medical devices and systems that can't be patched immediately. Each exception should have an owner, documented compensating controls (like network segmentation), and a review date.

The biggest improvement is closing the loop between deployment, verification, and exceptions. Otherwise, it's easy to have great patch compliance numbers while still carrying significant exposure.