A third-party catalog is the inventory of non-operating-system software that a patch management platform knows how to update, such as browsers, office suites, PDF readers, collaboration apps, and common utilities. In practice, this catalog determines what the platform can detect, approve, deploy, and report on beyond the OS itself.
It matters because many real-world vulnerabilities live in widely used applications rather than in the operating system. If a platform has weak catalog coverage, defenders may still be exposed even when OS patching is strong. Security teams use catalog depth to compare tools, check version support, and verify that the software actually running in the estate is covered. Attackers often rely on unpatched third-party apps to gain initial access or execute code, so a broad and accurate catalog is a core part of reducing attack surface. Good patch programs treat catalog coverage as a control, not just a feature.