Patching is the only mitigation that removes the flaw instead of making it harder to use, yet most patch programmes are measured by percentage compliance rather than by which attacker techniques they close. MITRE ATT&CK v20 maps mitigation M1051 Update Software to 42 techniques and sub-techniques across ten tactics, from public-facing application exploits to firmware implants and browser credential theft. This guide reads that mapping from a control owner's point of view: which techniques updates actually close, how to prioritise with the CISA Known Exploited Vulnerabilities (KEV) catalogue, EPSS and SSVC, what patching cannot undo, and how to measure it by technique. It is for vulnerability managers, platform owners and detection engineers. Process design and tooling are covered in the Patch Management Guide and prioritisation models in the Risk-Based Vulnerability Management Guide; this page does not repeat them.
Key takeaways
- M1051 is broader than exploitation. Beyond T1190, T1203, T1210 and T1068, ATT&CK maps updates to firmware, browser and IDE extensions, Office persistence, legacy credential exposure and network device configuration theft.
- Some mappings are one specific update. ATT&CK ties T1552.006 to KB2962486 (no passwords in Group Policy Preferences) and T1550.002 to KB2871997; check these are present, then clean up what they left behind.
- KEV sets the floor for urgency. Of 540 KEV entries added since January 2025 (catalogue version 2026.11.10, counting days from dateAdded to dueDate in each entry), 270 carried a 21-day federal due date and 157 a 3-day due date: build an emergency lane that can meet days, not weeks.
- Patching does not evict. If exploitation happened before the patch, stolen keys, tokens and web shells survive it, as ToolShell showed with ASP.NET machine keys.
- Measure exposure by technique. Track time to remediate KEV on internet-facing assets, firmware currency and unsupported software, not only monthly compliance.
What M1051 is in ATT&CK v20
ATT&CK defines M1051 as applying vendor patches and upgrades so that systems are protected against known vulnerabilities, covering operating systems, applications and firmware. Its implementation text has five measures: regular operating system updates (monthly Windows updates through WSUS or a similar tool, with scheduled reboots), application patching, firmware updates, emergency patch deployment (its example is applying an update to all affected Exchange servers within 24 hours), and centralised patch management with compliance reporting, supported by vulnerability scanning. D3FEND relates M1051 to one defensive technique, D3-SU Software Update: replacing old software on a computer system component.
NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning, frames the same activity as preventive maintenance, a routine cost of operating technology, which is the right mindset: M1051 is a standing process, not a project.
Techniques ATT&CK says M1051 mitigates
ATT&CK v20 data lists 42 current techniques. The table groups them by what the update actually does, in priority order for most organisations.
| Group | Techniques | What the update closes (per ATT&CK) |
|---|---|---|
| 1. Internet-facing exploitation | T1190 Exploit Public-Facing Application; T1189 Drive-by Compromise | Patch management for externally exposed applications; keep browsers and plugins updated. |
| 2. Exploitation after entry | T1203 Exploitation for Client Execution; T1210 Exploitation of Remote Services; T1068 Exploitation for Privilege Escalation; T1212 Exploitation for Credential Access; T1211 Exploitation for Stealth; T1611 Escape to Host | Regular patching of internal endpoints, servers and container hosts. |
| 3. Firmware and boot | T1542 Pre-OS Boot, T1542.001 System Firmware, T1542.002 Component Firmware; T1495 Firmware Corruption | Patch BIOS, EFI and component firmware to remove known vulnerabilities. |
| 4. Network devices | T1602 Data from Configuration Repository, T1602.001 SNMP (MIB Dump), T1602.002 Network Device Configuration Dump; T1686.002 Network Device Firewall | Keep device images updated and migrate to SNMPv3; keep network firewalls patched. |
| 5. Supply chain and tooling | T1195 Supply Chain Compromise, T1195.001, T1195.002; T1072 Software Deployment Tools | Remove unused, unmaintained or previously vulnerable dependencies and software; patch the deployment systems themselves. |
| 6. Credentials in clients | T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores, T1555.003 Credentials from Web Browsers, T1555.005 Password Managers; T1110.001 Password Guessing | Update browsers and password managers; upgrade management services to versions that add lockout or stronger authentication. |
| 7. Specific legacy fixes | T1552 Unsecured Credentials, T1552.006 Group Policy Preferences; T1550.002 Pass the Hash; T1546.010 AppInit DLLs; T1546.011 Application Shimming; T1548.002 Bypass User Account Control | KB2962486 (no new GPP passwords), KB2871997 (limits local administrator group access), Windows 8 or later with Secure Boot, KB3045645 (removes auto-elevate from sdbinst.exe), current Windows for UAC bypass protections. |
| 8. Persistence in applications | T1137 Office Application Startup, T1137.003 Outlook Forms, T1137.004 Outlook Home Page, T1137.005 Outlook Rules; T1176 Software Extensions, T1176.001 Browser Extensions, T1176.002 IDE Extensions | Office updates that close the Outlook methods (ATT&CK notes macro blocking alone may not); current browsers and IDEs. |
| 9. Generic hardening | T1548 Abuse Elevation Control Mechanism; T1546 Event Triggered Execution; T1574 Hijack Execution Flow, T1574.001 DLL | Regular updates, including fixes for DLL side-loading vulnerabilities. |
Group 7 is a practical audit list: those are named updates, so you can confirm them directly. Remember that KB2962486 stops new passwords being stored in Group Policy Preferences; existing cpassword values in SYSVOL still have to be found and removed, and the accounts behind them rotated.
Prioritising updates by technique and evidence
No organisation patches everything at once. Combine ATT&CK placement with exploitation evidence:
| Signal | What it tells you | How to use it |
|---|---|---|
| CISA KEV catalogue | A CVE with reliable evidence of exploitation in the wild and a clear remediation. Scanning, research and proof-of-concept code alone do not qualify. | Treat every KEV entry on your estate as top priority; CISA recommends this for all organisations, while BOD 22-01 binds only US federal civilian agencies. The dueDate in each entry is a useful benchmark. |
| KEV ransomware flag | 361 of 1,779 entries (catalogue 2026.11.10) are marked as known to be used in ransomware campaigns. | Move these ahead of other KEV items on systems that hold or reach business data. |
| EPSS (FIRST) | A probability from 0 to 1 that a CVE sees exploitation activity in the next 30 days, republished daily. | Rank the large non-KEV backlog; re-check daily for jumps. |
| SSVC (CISA) | Decision tree over exploitation status, technical impact, automatable, mission prevalence and public well-being impact, giving Track, Track*, Attend or Act. | Turn evidence into a documented decision and timeline; Act means remediate as soon as possible with leadership involved. |
| ATT&CK group | Where the flaw sits in an intrusion. | Groups 1 and 3 (internet-facing and firmware) first, then group 2 on high-value hosts. |
See the CISA KEV Catalogue Guide for catalogue mechanics.
How to implement M1051
- Know the estate. NCSC's guidance starts with identifying assets, owners and the vulnerabilities that affect them. Include appliances, firmware, browser extensions, IDE plugins and container base images, which are all in the mapping table.
- Update by default. NCSC's first principle is a policy to update by default, ideally automatically. Enable automatic updates for browsers, clients and endpoint operating systems, with deferral rings rather than manual approval.
- Run rings. Pilot (IT and security), early adopters, broad deployment, then critical servers after a soak period. Keep the previous version available and test uninstall or snapshot rollback for each ring.
- Build an emergency lane. A documented path to patch or isolate internet-facing systems within days, as ATT&CK's own 24-hour Exchange example shows. The Emergency Out-of-Band Patching Playbook covers the process.
- Cover firmware and network devices. Schedule BIOS, UEFI, BMC and network operating system updates; they close T1542, T1495 and T1602 and are often years behind. See the Firmware and Boot Security Guide.
- Retire what cannot be updated. KEV requires a clear remediation, which can be removing the product. Unsupported software has no M1051 option left; plan replacement or isolation.
- Own the exceptions. NCSC treats a decision not to update as a senior risk call recorded in the risk register. Pair every exception with compensating controls such as M1050 Exploit Protection or virtual patching, and an expiry date.
- Verify. Confirm installation with authenticated scanning, not only with the deployment tool's success report. See M1016 Vulnerability Scanning.
Where identity fits
Three identity issues run through M1051. First, the patch tool is itself a T1072 target: it runs as a highly privileged service account on every endpoint, so protect its credentials and console as tier-zero assets. See If your patch management tool is compromised. Second, edge appliances hold service account passwords, directory bind accounts, certificates and API keys; if they were exploited before patching, those secrets must be treated as stolen. Third, several group 7 fixes exist only because credentials were exposed (GPP passwords, local administrator hash reuse), so the patch must be followed by credential rotation. See the Service Account Security Guide.
What M1051 does not stop
- Zero-days and the patch gap: in the Ivanti Connect Secure case, exploitation began around 3 December 2023, disclosure came on 10 January 2024 and patches on 31 January 2024. For weeks the only measures were mitigations, isolation and detection. See the Ivanti Connect Secure exploitation breach analysis.
- Persistence that survives the patch: in ToolShell, attackers read SharePoint's ASP.NET machine keys through a web shell; Microsoft and CISA told administrators to rotate the keys and restart IIS after patching, because the keys allowed code execution on demand. See the ToolShell SharePoint exploitation breach analysis.
- Misconfiguration and design issues: exposed management interfaces, default credentials and over-permissive roles are not fixed by updates; see M1054 Software Configuration.
- Valid credentials: T1078 needs no flaw at all.
- Malicious updates: the T1195.002 mapping is about removing vulnerable and unmaintained software, not about trusting whatever arrives through the update channel; code signing and provenance checks cover that.
Detection and measurement
Pair exposure metrics with detection for the window before a patch lands: exploit attempts against internet-facing services, unexpected child processes from web servers, and new files in web roots. KPIs:
- KEV time to remediate: median and 90th percentile days from KEV addition to remediation, split by internet-facing and internal assets.
- KEV exposure today: count of open KEV CVEs on your estate, with ransomware-flagged entries separately.
- Emergency lane performance: hours from decision to patched or isolated for Act-level vulnerabilities.
- Firmware currency: share of servers, laptops and network devices on the latest vendor firmware.
- Unsupported software: count of end-of-life operating systems and applications still running, with exception status.
- Post-patch hygiene: for each exploited-before-patch event, whether credentials and keys on the host were rotated.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 Flaw Remediation; SI-2(2) Automated Flaw Remediation Status; SI-2(5) Automatic Software and Firmware Updates; RA-5 Vulnerability Monitoring and Scanning | Core control for M1051, its automation and its verification. |
| NIST CSF 2.0 | PR.PS-02; ID.RA-01; ID.RA-08 | Software maintained, replaced and removed commensurate with risk; vulnerabilities identified; disclosure handling. |
| CIS Controls v8.1 | Control 7 Continuous Vulnerability Management (7.3 automated operating system patch management, 7.4 automated application patch management) | Direct match. See the CIS Control 7 Continuous Vulnerability Management Guide. |
| ISO/IEC 27001:2022 | Annex A 8.8 Management of technical vulnerabilities | Obtain vulnerability information, evaluate exposure, take measures. |
| MITRE D3FEND | D3-SU Software Update | The defensive technique D3FEND relates to M1051. |
Common failure patterns
- Compliance percentage hides the edge: 98 percent of laptops patched while the VPN gateway waits for a maintenance window.
- Patch and walk away: no hunt or credential rotation on systems that were exposed before the fix, as in ToolShell.
- Firmware never in scope: operating systems patched monthly, BIOS and BMC firmware untouched since purchase.
- Deployment success taken as proof: the tool reports success, the service was never restarted, and the vulnerable version is still loaded.
- Extensions and plugins forgotten: browsers update automatically, but browser and IDE extensions and their permissions are never reviewed (T1176).
- Exceptions with no end date: legacy systems excluded indefinitely with no isolation or compensating controls.
Practitioner checklist
- Map your asset inventory to the nine technique groups in this guide and find the gaps.
- Pull KEV daily and match it to your estate automatically; flag ransomware-associated entries.
- Rank the rest with EPSS and record decisions with SSVC outcomes.
- Run ring-based automatic updates with tested rollback.
- Maintain an emergency lane that can patch or isolate internet-facing systems within days.
- Bring firmware and network device images into the patch cycle.
- Confirm the group 7 legacy updates and remove leftover GPP passwords.
- Protect the patch platform's service accounts and console as tier-zero.
- After any exploitation before patch, rotate keys, tokens and service credentials on the host.
- Report KEV time to remediate and unsupported software to leadership monthly.
Standards and references
- MITRE ATT&CK: M1051 Update Software
- NIST: SP 800-40 Rev. 4 Guide to Enterprise Patch Management Planning
- CISA: Known Exploited Vulnerabilities Catalog
- CISA: Stakeholder-Specific Vulnerability Categorization (SSVC)
- FIRST: Exploit Prediction Scoring System (EPSS)
- NCSC: Vulnerability management guidance
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
- MITRE D3FEND: Knowledge graph of cybersecurity countermeasures
Related NHI Mgmt Group resources: Patch Management Guide · Risk-Based Vulnerability Management Guide · CISA KEV Catalogue Guide · Exploited Vulnerability Breaches · M1050 Exploit Protection