What Is Patch Gap?
The patch gap is the time between a fix for a vulnerability becoming available and that fix being applied in your production systems or code. During the gap, the vulnerability is publicly known but still exploitable in your environment.
Also known as:
Why the Patch Gap Matters
Once a vulnerability and its fix are public, attackers can study the patch to understand the flaw and build an exploit. Every day a known-vulnerable system stays unpatched is a day it can be attacked with public information. The CISA Known Exploited Vulnerabilities catalog exists because attackers routinely exploit vulnerabilities that already have fixes available.
What Causes a Patch Gap
- Discovery delays. Teams do not know the vulnerable component is in their code or infrastructure.
- Prioritization queues. The fix waits behind other findings with similar severity scores.
- Breaking changes. An upgrade fails the build or changes behavior, so it needs engineering work.
- Ownership questions. No one is sure which team should apply the fix.
- Review and release cycles. The fix waits for review, testing and the next deployment.
Measuring the Patch Gap
Teams usually track it as time from fix availability, or from detection, to the fix being merged and deployed, often reported as mean time to remediate (MTTR). Measuring it separately for actively exploited vulnerabilities shows whether the most urgent fixes move faster than the rest.
How to Close the Patch Gap
NIST SP 800-40 Rev. 4 treats patching as preventive maintenance and recommends a planned enterprise strategy rather than ad hoc effort. In practice that means a full inventory, prioritization that reacts to threat intelligence, clear owners and fixes that are tested before they reach reviewers, so a patch is not delayed by rework.
How Nullify Shortens the Patch Gap
Nullify moves actively exploited vulnerabilities and zero-days affecting your stack to the top of the backlog, writes a minimal fix and validates it against your build before the pull request opens, routes it to the code owner and repairs CI failures until it passes. Stalled fixes are escalated in Slack against your SLA, and developers approve every merge. See how Nullify fixes and routes findings.
Key Takeaways
- The patch gap is the time between a fix being available and it being applied.
- During the gap, a known vulnerability is still exploitable in your environment.
- Delays come from discovery, prioritization, breaking changes, ownership and review.
- Close it with inventory, threat-aware prioritization and fixes that are validated before review.
Read More About Patch Gap
Reduce MTTR
See Nullify in Action
Nullify takes the waiting out of every step between a finding and a merged fix.