Dynamic patch management system and method

A system for managing deployment of a software patch, comprising:

• one or more processors;
• and
• a memory storing instructions that, when executed by the one or more processors, cause the system to:
• acquire vendor-supplied patch data associated with the software patch;
• acquire platform-based data comprising telemetry or performance data collected from one or more client devices via a computer network;
• acquire community-sourced patch data originating from one or more external sources of data other than a patch vendor or a patch management platform;
• process at least a portion of the vendor-supplied patch data, the community-sourced patch data, and the platform-based data using a machine-learning model trained on historical patch data and historical deployment outcomes;
• generate, by the machine-learning model, a bounded risk representation indicative of a likelihood that installation of the software patch will adversely affect at least one client device;
• select, based on the bounded risk representation, a deployment action comprising at least one of:
• deploying the software patch to at least a first subset of the client devices;
• deferring deployment of the software patch;
• withholding deployment of the software patch;
• or
• generating a notification to a technician computer system;
• and
• cause execution of the deployment action on the one or more client devices.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a patch management system, cause the processors to:

• acquire vendor-supplied patch data associated with a software patch;
• acquire platform-based data comprising telemetry or performance data collected from one or more client devices via a computer network;
• acquire community-sourced patch data originating from one or more external sources of data other than a patch vendor or a patch management platform;
• process at least a portion of the vendor-supplied patch data, the community-sourced patch data, and the platform-based data using a machine-learning model trained on historical patch data and historical deployment outcomes, the processing comprising generating, by the machine-learning model, a bounded risk representation indicative of a likelihood that installation of the software patch will adversely affect at least one client device;
• generate, based at least in part on the bounded risk representation and device-classification information, a plurality of deployment rings defining different subsets of the client devices and an order in which the software patch is to be deployed to the different subsets;
• dynamically recalculate at least one of the plurality of deployment rings in response to updated platform-based data indicating at least one of performance degradation, anomaly rates satisfying a threshold, or stability across one or more of the deployment rings;
• select a deployment action for the software patch based on at least one of the bounded risk representation, the plurality of deployment rings, or the recalculated deployment rings, the deployment action comprising at least one of:
• deploying the software patch to one or more of the plurality of deployment rings;
• deferring deployment to at least one of the plurality of deployment rings;
• or
• withholding deployment to one or more of the plurality of deployment rings;
• and cause execution of the selected deployment action on the client devices.