Differentiate patch management from vulnerability scanning and explain how they work together.

• A. Patch management scans for flaws; vulnerability scanning deploys fixes.
• B. Vulnerability scanning identifies flaws; patch management deploys fixes; Scanning informs prioritization; Patching closes vulnerabilities to reduce risk.
• C. They are the same thing
• D. Patch management only applies to software updates on servers

Answer: (B)

Vulnerability scanning and patch management are two complementary steps in reducing risk, each with its own purpose. Vulnerability scanning looks across your assets to identify weaknesses, missing patches, misconfigurations, and other exposures. It provides a list of flaws, along with severity and context, so you know where the risk lives and how it might be exploited. Patch management, on the other hand, is the process of obtaining, testing, deploying, and verifying fixes for those flaws—whether as patches for software, firmware updates, or configuration changes.

The reason this pairing is so effective is that scanning guides what needs fixing and in what order. By analyzing the severity, asset criticality, exploit availability, and exposure, the scanner helps you prioritize which vulnerabilities to address first. Patch management then executes those fixes, aiming to close the gaps and reduce the overall risk. After patches are applied, re-scanning or verification confirms that the vulnerabilities have been remediated and that patches are correctly installed.

For example, a vulnerability scan might reveal an unpatched web server with a high-severity CVE. Patch management would schedule and deploy the vendor patch to that server, and a follow-up scan would verify that the CVE is resolved and no new issues were introduced. This shows how the two functions work together to identify, prioritize, remediate, and verify fixes, rather than being the same activity or limited to only servers.