A patch management review for business devices is not a penetration test. It looks at how updates are approved, delayed, and confirmed on the machines people use every day.
On Windows fleets we typically examine update rings, WSUS or cloud update policies, restart deadlines, and whether servers and laptops share the same freeze rules. On macOS we look at MDM deferrals, major-version lag, and whether personal Apple IDs interfere with supervised updates.
Mobile phones and tablets enter the picture when they hold company mail or authenticator apps. Reviewers sample enrolments and check whether security patches track the same cadence as laptops.
Outside scope sits network appliance firmware, cloud SaaS configuration, and phishing simulations—unless those topics are booked as separate work. Keeping the review tight produces findings operations teams can act on within a sprint.