How OT teams can run safe, OEM-validated patch management on operating systems Microsoft no longer supports. For plant security leads, OT engineers and industrial CISOs.
Industrial patch management is the practice of identifying, validating and applying security patches to PC-based assets in industrial environments: HMI workstations, SCADA servers, engineering workstations and historians. It differs from IT patch management because OEM validation cycles, scheduled production windows, regulatory compliance and legacy operating system support constrain when and how patches can be deployed.
Key takeaways
OT patch management is not IT patch management. Industrial automation vendors discourage or prohibit OS patching outside their validated release cycles. Many plants run operating systems months or years behind the public patch state, often on operating systems Microsoft no longer supports.
Windows 10 reached end of support on October 14, 2025. Without Microsoft Extended Security Updates (ESU) at $61 per device for Year 1, doubling each year (maximum three years through October 2028), Windows 10 endpoints stop receiving security patches.
Windows XP, Server 2003 and Windows 7 are still running in OT. OEM certification, regulatory validation and hardware-software dependencies keep them in production.
The right approach combines four things: OEM-validated patching, pre-patch imaging for rollback, compensating controls for unpatchable systems and a migration runway tied to OEM (not Microsoft) timelines.
Acronis Cyber Protect for OT delivers all four on a single agent. Vulnerability assessment, patch management with automated pre-patch imaging, offline behavioral protection and image-based backup with One-Click Recovery.
Why is OT patch management different from IT patch management?
Industrial patch management runs on OEM validation cycles, not Microsoft cycles. Rockwell, Siemens, Schneider, AVEVA and other automation vendors certify their HMI and SCADA software against specific OS versions and patch levels. Applying a Microsoft patch outside that validated cycle can break the certified application and void support.
Patching can stop production: a failed patch on an HMI driving a chemical batch reactor or a SCADA server can stop production, trigger a safety event or disrupt a regulatory-validated process. Reboots have to be scheduled around production, and plants that run continuous processes may have only one or two patch windows per year. Compliance dependencies apply: pharma plants run validated systems under GxP and FDA 21 CFR Part 11; utilities under NERC CIP. Patching without re-validation can break the compliance posture. And many endpoints run operating systems Microsoft no longer supports at all.
What are the Windows 10 end-of-support options for OT?
Windows 10 reached end of support on October 14, 2025. The first post-EOS Patch Tuesday in November 2025 included CVE-2025-62215, an actively-exploited Windows kernel privilege-escalation vulnerability. Non-ESU Windows 10 endpoints did not receive that patch. Industry estimates put 400 million or more Windows 10 devices at end of support globally, with a large share in OT.
ESU pricing math. A plant with 200 Windows 10 endpoints faces an ESU bill of $12,200 in Year 1, $24,400 in Year 2 and $48,800 in Year 3. Total: $85,400 over three years. ESU is a migration bridge for endpoints with a clear path to Windows 11. For endpoints that will never migrate, compensating controls become the better long-term answer.
Can OT plants still run Windows XP, Server 2003 and Windows 7?
Yes, and many plants do. These operating systems remain in production OT because the OEM-certified HMI or SCADA application requires it (AVEVA InTouch, Wonderware, Rockwell FactoryTalk View SE, Siemens WinCC and GE iFIX versions validated only against XP, Server 2003 or Windows 7), because of hardware-software-OS dependencies (PCI cards, serial communication boards with no Windows 10 or 11 driver), because re-validation costs in pharma and defense can run into hundreds of thousands of dollars, and because the system works.
Microsoft will not patch these again. NIST SP 800-82 Rev 3 endorses four compensating controls: network segmentation to reduce attack surface, behavioral protection that does not depend on OS patches, image-based backup with rapid recovery so the worst case is hours not days, and aggressive removable-media controls since USB is now the dominant attack vector for isolated industrial systems.
What is the industrial patch management workflow?
Eight steps that hold up in production OT.
- Complete asset inventory with OS version, OEM application and current patch level for every PC-based OT asset.
- Vulnerability assessment prioritized by exploitability (CISA published 400+ ICS advisories in 2025), exposure and operational criticality.
- OEM validation status check before any patch is queued. Rockwell, Siemens and Schneider publish validation matrices.
- Testing in a staging environment or digital twin for one to two weeks before production rollout.
- Pre-patch imaging of every endpoint immediately before patching. The image is the rollback path. This single control prevents most patch-failure outages.
- Scheduled deployment in approved patch windows aligned with planned shutdowns or low-production hours.
- Post-patch validation that the OEM application functions, historian writes complete and safety interlocks operate as designed.
- Documentation and audit trail for every patch decision (deploy, defer, never apply) with rationale and validation evidence.
How does Acronis Cyber Protect for OT deliver industrial patch management?
Recommended for
Manufacturers, utilities, energy operators and pharmaceutical companies running a mix of patchable and unpatchable OT endpoints. Particularly strong fit for plants with significant legacy Windows footprint (XP, 7, 10), upcoming Windows 10 ESU exposure and IEC 62443, NIS 2, NERC CIP or GxP obligations. Learn more: /products/cyber-protect-ot/.
How does industrial patch management map to compliance frameworks?
IEC 62443-3-3 SR 3.4 (software and information integrity), SR 7.4 (system recovery) and SR 3.2 (malicious code protection) all apply to patch management workflows and compensating controls. IEC 62443-4-1 covers supplier SSDLC (Acronis is certified). NIST SP 800-82 Rev 3 Section 6 covers patch management for industrial control systems with explicit compensating-control guidance. NIS 2 Article 21 requires basic cyber hygiene and patch management. NERC CIP-007 covers system security management with specific patch timelines. GxP covers data integrity for pharma.
Written by
About Acronis
Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland.
