Third-party patching
Updating the non-Microsoft software on your machines, which is where a large share of exploited vulnerabilities live.
Windows Update handles Microsoft products and nothing else. Browsers, PDF readers, Java runtimes, compression tools, and remote access clients all update on their own schedules or not at all, and they are heavily targeted precisely because they are commonly out of date.
Automating it is the only approach that holds at scale, with a defined exclusion list for the applications that genuinely cannot be updated without breaking something, so those get handled deliberately rather than forgotten.
Where this comes up
Third-party patching sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.