---
title: "Understanding Patch State Evaluation"
slug: "understanding-patch-state-evaluation"
updated: 2026-10-22T15:02:28Z
published: 2026-10-22T15:02:28Z
canonical: "docs.safe.security/understanding-patch-state-evaluation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Understanding Patch State Evaluation

## Understanding Patch State Evaluation

This article defines how patch states are evaluated for Operating Systems and Software, and how the overall state is determined based on a worst-case logic hierarchy.

### Patch State Scopes

The system evaluates patch status using three distinct categories:

- **OS Patch State:** Evaluated based on the installed operating system only.
- **Software Patch State:** Evaluated based on all non-OS software. This state reflects the worst case across all software instances.
- **Patch State:** Evaluated based on the combination of operating system and non-OS software. This state reflects the worst case across all OS and Software instances.

---

### State Classifications & Hierarchy

The system determines the overall state by identifying the "worst" status among all relevant instances. The hierarchy of states, ordered from worst to best, is defined as follows:

1. **EOL (Worst):** The operating system or software has reached its End of Life and is no longer supported by the vendor.
2. **Unpatched:** A security patch is available for the software or OS but has not been applied.
3. **Vulnerable:** The instance is identified as having a known security vulnerability.
4. **Patched:** The instance is up-to-date with applicable security updates.
5. **Unknown:** The state cannot be determined due to missing or insufficient data.

### Logic Example

Because the evaluation logic prioritizes the worst status found:

> If any single software instance is found with a status of **EOL**, the overall **Software Patch State** results in **EOL**.