■ Signal DeskExploited-now security news, threat hunting, AI security and practical playbooks.

← Playbooks

Patch Tuesday Triage

A six-step path from release-notes day to verified rollout. Work top to bottom; each step ends with a checklist.

For: Security lead, Sysadmin, Helpdesk

1. Pull the facts2. Map to what you own3. Rank by real risk4. Mitigate what you can't patch today5. Roll out in rings6. Verify and close
  1. Step 1 of 6

    Pull the facts

    Start from primary sources, not headlines. Open the MSRC release notes and the CISA KEV catalog side by side.

    • Note every CVE Microsoft marks 'Exploitation Detected'
    • Note anything publicly disclosed
    • Check KEV for same-day additions and their due dates
    • Record the KB numbers for each Windows build you run
  2. Step 2 of 6

    Map to what you own

    A critical bug in a product you don't run is noise. Match the list against your asset inventory.

    • List affected products present in your estate (Exchange, AD DS, Outlook, DHCP, MSMQ, QUIC, Hyper-V)
    • Flag internet-facing systems
    • Flag domain controllers and identity infrastructure separately
  3. Step 3 of 6

    Rank by real risk

    Order: exploited and exposed → exploited internal → 'More Likely' on exposed services → everything else.

    • Exploited zero-days get an emergency change
    • Check whether features like the Outlook Preview Pane are an attack vector
    • Write down the order and why, in one line per item
  4. Step 4 of 6

    Mitigate what you can't patch today

    Buy time where patching needs a maintenance window.

    • Apply vendor workarounds where published
    • Restrict exposure (firewall, disable unused roles like MSMQ)
    • Turn on extra logging or detection for the affected component
  5. Step 5 of 6

    Roll out in rings

    Pilot, then broad, then the stragglers. Keep a rollback plan for domain controllers and Exchange.

    • Ring 0: IT and test devices within 24 hours
    • Ring 1: broad endpoints within the week
    • Servers in agreed windows; DCs one at a time
    • Track failed installs and reboots pending
  6. Step 6 of 6

    Verify and close

    A deployed patch isn't a fixed vulnerability until you've checked.

    • Confirm build numbers or KBs installed via your management tool
    • Rescan with your vulnerability scanner
    • Hunt for signs of exploitation predating the patch on exposed systems
    • Log exceptions with an owner and expiry date

Original content by Signal Desk. Printable checklist: use your browser's print view.