Patch compliance percentages can hide critical exceptions
Ninety-eight per cent patched sounds excellent and tells you nothing about the two per cent.
If the remaining systems are the internet-facing ones, or the domain controllers, or the machines that could not be restarted, the headline figure is actively misleading. Averages conceal exactly the cases that matter, and a report that leads with a percentage without naming the exceptions is designed to reassure rather than inform.
More on Endpoint security
- EDR visibility depends on the sensor being aliveSilence is not the same as safety
- Application allowlisting controls execution, not intentThe list checks the name
- Local admin changes the consequence of compromiseOne click, two blast radii
- Device compliance is a snapshot, not permanent healthA tick is a photograph
- Full-disk encryption protects a powered-off device bestAt rest means switched off
- USB controls are a system design problemDesign the socket, not the poster