Patch Compliance Rate
Percentage of systems with critical security patches applied within the required timeframe
What is Patch Compliance Rate?
Patch compliance rate is the percentage of systems that receive required security updates within the agreed time. It shows how well an organisation keeps its software up to date.
Unpatched systems are one of the most common ways attackers get in, so high compliance is a core security control.
How this KPI is measured
- Function
- Information Technology
- Sub-function
- Cyber Security
- Industry
- All Industries
- Type
- Leading
- Impact
- Risk
- Unit
- %
- Measurement frequency
- Weekly / Monthly
- Formula
- (Systems patched within SLA / Total systems requiring patch) × 100
How to calculate it
Divide systems patched within the service level agreement (SLA) by total systems requiring a patch, and multiply by 100.
For example, if 920 of 1,000 systems were patched within the required time, compliance is 92%.
Set different deadlines by severity, with critical patches applied fastest, and track exceptions with a reason and an end date.
Where it is used
Reducing vulnerability
Keep systems current.
Meeting policy and audit needs
Show control.
Finding hard-to-patch systems
Focus effort.
How to improve it
Tips and common mistakes
- Test patches to avoid disruption.
- Track unmanaged devices too.
- Critical patches should have the tightest deadlines.
More Information Technology kpi library
Build better plans, faster
Join the waitlist for early access to curated insights, flexible templates, and rapid iteration across strategy, planning, and project management.