Understanding the Risk

Critical databases are left unpatched for months or even years, vulnerable to attacks that result in data theft, breaches of privacy and non-compliance with regulatory requirements.

Irregular Patching Leaves Databases at Risk

When a vulnerability is discovered, or an exploit is published, it often takes database vendors months to release a security patch.

When the security patch is issued, however, most enterprises are not quick to patch their databases and many do not patch them at all.

There are many valid reasons why enterprises don't patch in a timely manner:
	Patching is an update to the DBMS kernel and requires database downtime. This is often not an option in 24x7 environments, or is extremely difficult to coordinate. Patching requires regression testing of all applications running on top of the database. Many application vendors only certify their applications to run on top of specific releases of DBMSs - updates not included.
Sentrigo Survey of 315 Oracle Professionals, January 2008