A State-dependent Patching Policy for Software Systems with Heterogeneous Vulnerabilities

Security vulnerabilities pose significant risks to modern software systems, making effective patch management essential. Most existing studies focus on static patching rules that do not respond to the current vulnerability state. This limitation becomes particularly important when vulnerabilities are heterogeneous, because system risk depends not only on the number of unpatched vulnerabilities but also on their severity composition. To address this issue, we develop a state-dependent patching policy for software systems with heterogeneous vulnerabilities. We model the stochastic accumulation of vulnerabilities and formulate the patching problem as a finite-horizon Markov decision process. For the baseline case of perfect patching, we show that the optimal policy exhibits a control-limit structure that can be expressed as a threshold rule based on the current damage cost, and we develop a backward-induction algorithm to compute the corresponding thresholds. We then extend the model to imperfect patching, in which patch deployment may introduce new vulnerabilities, and show that the threshold structure is preserved. Numerical experiments demonstrate that the proposed policy outperforms both time-based and number-based benchmark policies, with more pronounced advantages in environments characterized by greater vulnerability heterogeneity and lower patch quality. These findings provide practical guidance for designing adaptive and risk-aware patching policies.