# To Patch or Not to Patch: Motivations, Challenges, and Implications for Cybersecurity

arXiv: https://arxiv.org/abs/2502.17703 · HTML: https://mlsanity.com/paper/2502.17703/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 54 references that are in the map.
- First posted on arXiv 24 Feb 2025.

## Builds on (most cited first, 9 of 9)

- [Teams of LLM Agents can Exploit Zero-Day Vulnerabilities](https://mlsanity.com/paper/2406.01637/) (2024)
- [Large Language Model for Vulnerability Detection and Repair: Literature Review and the Road Ahead](https://mlsanity.com/paper/2404.02525/) (2024)
- [Exploring ChatGPT's Capabilities on Vulnerability Management](https://mlsanity.com/paper/2311.06530/) (2023)
- [Software Security Patch Management -- A Systematic Literature Review of Challenges, Approaches, Tools and Practices](https://mlsanity.com/paper/2012.00544/) (2020)
- [Developing a cyber security culture: Current practices and future needs](https://mlsanity.com/paper/2106.14701/) (2021)
- [Developing cybersecurity education and awareness programmes for Small and medium-sized enterprises (SMEs)](https://mlsanity.com/paper/1906.09594/) (2019)
- [An Empirical Study of Automation in Software Security Patch Management](https://mlsanity.com/paper/2209.01518/) (2022)
- [Generative Artificial Intelligence-Supported Pentesting: A Comparison between Claude Opus, GPT-4, and Copilot](https://mlsanity.com/paper/2501.06963/) (2025)
- [Towards the generation of hierarchical attack models from cybersecurity vulnerabilities using language models](https://mlsanity.com/paper/2410.05351/) (2024)

## Abstract (arXiv)

As technology has become more embedded into our society, the security of modern-day systems is paramount. One topic which is constantly under discussion is that of patching, or more specifically, the installation of updates that remediate security vulnerabilities in software or hardware systems. This continued deliberation is motivated by complexities involved with patching; in particular, the various incentives and disincentives for organizations and their cybersecurity teams when deciding whether to patch. In this paper, we take a fresh look at the question of patching and critically explore why organizations and IT/security teams choose to patch or decide against it (either explicitly or due to inaction). We tackle this question by aggregating and synthesizing prominent research and industry literature on the incentives and disincentives for patching, specifically considering the human aspects in the context of these motives. Through this research, this study identifies key motivators such as organizational needs, the IT/security team's relationship with vendors, and legal and regulatory requirements placed on the business and its staff. There are also numerous significant reasons discovered for why the decision is taken not to patch, including limited resources (e.g., person-power), challenges with manual patch management tasks, human error, bad patches, unreliable patch management tools, and the perception that related vulnerabilities would not be exploited. These disincentives, in combination with the motivators above, highlight the difficult balance that organizations and their security teams need to maintain on a daily basis. Finally, we conclude by discussing implications of these findings and important future considerations.