Selective patching is a risk-based update strategy used in operational technology (OT) environments. Instead of applying every fix immediately, defenders prioritize the most important vulnerabilities, test the update against the exact hardware and control logic in use, and deploy it during a maintenance window that will not disrupt the process. This matters because industrial systems often control physical equipment, so a bad update can cause downtime, unsafe behavior, or loss of production.
In practice, selective patching appears as part of a broader change-management process. Security teams may patch only the highest-risk PLCs, HMIs, or servers first, while delaying lower-risk systems until validation is complete. When patching must wait, defenders use compensating controls such as segmentation, restricted access, and monitoring for unauthorized parameter changes. Attackers benefit from patch delays, since known flaws may stay exposed; defenders use selective patching to reduce that exposure without breaking critical operations.