A pre-patch check is a security review performed before, or alongside, applying a fix to determine whether a system was already compromised. It goes beyond confirming the vulnerable version is installed; it asks whether attackers used the flaw first, changed settings, created accounts, or stole credentials.
This matters because patching alone does not remove attacker activity that happened before remediation. On edge appliances, VPNs, and authentication gateways, a compromised device can still expose sessions or trust relationships even after it is updated. Defenders use logs, file and configuration integrity checks, authentication history, and indicators of compromise to decide whether the system can be trusted again. In practice, a pre-patch check turns routine maintenance into incident response when needed.