Understanding Patch State Evaluation
This article defines how patch states are evaluated for Operating Systems and Software, and how the overall state is determined based on a worst-case logic hierarchy.
Patch State Scopes
The system evaluates patch status using three distinct categories:
OS Patch State: Evaluated based on the installed operating system only.
Software Patch State: Evaluated based on all non-OS software. This state reflects the worst case across all software instances.
Patch State: Evaluated based on the combination of operating system and non-OS software. This state reflects the worst case across all OS and Software instances.
State Classifications & Hierarchy
The system determines the overall state by identifying the "worst" status among all relevant instances. The hierarchy of states, ordered from worst to best, is defined as follows:
EOL (Worst): The operating system or software has reached its End of Life and is no longer supported by the vendor.
Unpatched: A security patch is available for the software or OS but has not been applied.
Vulnerable: The instance is identified as having a known security vulnerability.
Patched: The instance is up-to-date with applicable security updates.
Unknown: The state cannot be determined due to missing or insufficient data.
Logic Example
Because the evaluation logic prioritizes the worst status found:
If any single software instance is found with a status of EOL, the overall Software Patch State results in EOL.