Automate Enterprise Patch Management

This skill designs enterprise patch management workflows spanning risk assessment through emergency response. Risk-based prioritization classifies patches into four SLA tiers - Critical (0-72 hours), High (7 days), Medium (30 days), Low (90 days) - driven by CVSS score, EPSS exploit probability, asset criticality, and exposure, integrated with vulnerability scanners like Nessus, Qualys, or Rapid7. Environment segregation follows a Development to Testing to Staging to Production pipeline with identical configurations and change control between stages, using blue-green or canary strategies for production rollout.

A PatchAssessment class fetches vulnerability data above a CVSS threshold, categorizes it into critical/high/medium/low buckets (flagging actively-exploited vulnerabilities as critical regardless of raw score), and generates a deployment schedule with a specific deadline per category. An Ansible playbook automates deployment with rolling batches (serial: 25%) and a fail-percentage circuit breaker, pre-tasks that open a monitoring maintenance window, run a health check, and snapshot the VM before patching, OS-specific security-only update tasks for RHEL/CentOS and Debian/Ubuntu, and post-tasks that re-verify health and update the CMDB with patch status.

def categorize_patches(self, vulnerabilities):
    for vuln in vulnerabilities:
        if vuln['cvss_score'] >= 9.0 or vuln['exploited_in_wild']:
            categories['critical'].append(vuln)
        elif vuln['cvss_score'] >= 7.0:
            categories['high'].append(vuln)

A validation pipeline checks service health endpoints per environment, runs a performance regression test against a 7-day baseline with a 15% threshold, executes a security scan, and generates a structured JSON validation report. Compliance reporting uses a SQL query joining server and vulnerability data to compute per-host overdue-patch counts against the CVSS-tiered SLA deadlines and flag overall compliance status. Emergency zero-day response follows a three-phase timeline: immediate assessment (0-4 hours, impact validation and temporary mitigations like WAF rules), rapid deployment (4-24 hours, abbreviated testing in a representative environment), and production rollout (24-72 hours, staged deployment with enhanced monitoring and rollback readiness). Best practices cover maintaining production-mirrored patch testing labs, automated rollback, configuration drift detection, clear outage communication channels, tabletop exercises, change-management integration, vendor bulletin monitoring, and tracking MTTR/success rate/rollback frequency metrics.

Use this skill when designing or running a patch management program - prioritizing vulnerabilities by risk and SLA tier, automating deployment via Ansible with proper rollback safety, validating patches with health/performance/security checks, generating compliance reports, or responding to zero-day emergencies.

It is not the right fit for application-level dependency updates unrelated to OS/infrastructure security patching, or for environments too small to warrant staged environment pipelines and automated rollback - a manual, ad-hoc process may be sufficient there.

Input: vulnerability scan data (CVSS scores, exploit status), the server/asset inventory with criticality tiers, and the environment pipeline to deploy through. Output: a categorized, SLA-scheduled patch list, an Ansible-automated deployment playbook with snapshotting and health checks, a validation report confirming service health and performance post-patch, a compliance dashboard query flagging overdue patches per host, and an emergency zero-day response procedure.

Built on vulnerability scanners (Nessus, Qualys, Rapid7), Ansible for configuration-managed patch deployment, VMware for pre-patch snapshotting, a CMDB for patch status tracking, and SQL for compliance reporting against vulnerability and server inventory data.

Infrastructure and security engineers managing enterprise patch programs - particularly those needing risk-based prioritization, automated deployment with rollback safety, validation testing, and audit-ready compliance reporting.