A candidate patch is a proposed code change intended to fix a vulnerability, bug, or security flaw, but it is not yet trusted as a final remedy. It may be generated by a developer, a scanner, or an AI system, and it still needs human review, testing, and validation before it is merged or deployed.
In cybersecurity, candidate patches matter because a fix can look correct while still being incomplete, unsafe, or disruptive. A weak patch may miss the real root cause, break authentication or input handling, or create a new vulnerability elsewhere in the code path. Defenders treat it as a starting point: they reproduce the issue, run regression tests, review the diff for security impact, and only then accept it as a proper patch. This human-in-the-loop process helps prevent false confidence in automated remediation.