SANS Top Cyber Security Risks report shows application patching is much slower than Operating System patching.

Why does this occur?
Is patching applications more difficult? In some cases patching JAVA may be cause issues with internal applications. But I haven't seen a case yet where a Flash or Adobe Reader update has caused an issue. (I'm talking security bulletings not major releases).

Is the problem culteral? It took people a while to get in the habit of rolling out Operating System patching. Perhaps they just haven't crossed the Application hurdle yet.

Is it the tools? SMS/Config Manager doesn't seem to make deployment easy. Perhaps I'm doing it wrong, but with third party applications I have to use a script I downloaded from myitforum.com in order to customize the user install experience (ability to postpone). Having to update that for each application I'm pushing is a pain. My impression is that ConfigMgr's competitors are much better at doing this. ConfigMgr is also quite difficult to use under our security policy if you want to patch remote users who don't use the VPN.

I suspect a lot of mid-size and smaller businesses have just set up a WSUS server. WSUS lacks the capability of deploying application updates. (although googling shows an interesting add-on from a third party to add this functionality).

Applying third party application updates is time intensive. I deploy them one at a time. With Microsoft patches they are all deployed at once. Upgrade fatigue sets in much more quickly due to the greater frequency of these individually deployed third party plugins.

Improving application patching requires more than telling the administrator to work harder. The tools need to be improved so we can do our job. Microsoft needs to step it up with ConfigMgr. It needs to be easier to patch non-Microsoft products or customers will start checkout out competitors.