Windows and macOS vulnerability management: A practical guide

Windows and macOS vulnerability management means identifying vulnerable systems and applications, prioritizing affected devices by risk, applying the right fix for each platform, and verifying the result. One process handles both operating systems, but applicability, update requirements, and remediation evidence differ between Windows and macOS. This guide walks through each step with PDQ as the operational example.

How do you identify vulnerable Windows and macOS endpoints?

Identify affected endpoints by matching current device and software data to the vulnerability's actual platform and version requirements. An application name alone doesn't establish that both operating systems are exposed.

For each finding, answer these questions before acting:

• Which devices are affected?

• What operating system and build does each device run?

• Which application version or component is involved?

• Does the vendor advisory actually apply to that platform?

• How current is your supporting inventory?

This matters more than it sounds. For instance, Google's March 2025 advisory for CVE-2025-2783 described a vulnerability in Mojo on Windows with confirmed exploitation in the wild. Having Chrome installed on both Windows and Macs didn't mean both platforms were vulnerable to that specific CVE; only Windows was affected.

The goal is an affected-device scope separated by platform where necessary instead of an undifferentiated list of "devices with Chrome."

How do you prioritize vulnerabilities across Windows and macOS?

Prioritize affected endpoints using the same risk criteria across both platforms, then account for the exposure and business importance of the specific devices.

CVSS Base scores express intrinsic severity. CISA's Known Exploited Vulnerabilities Catalog identifies vulnerabilities known to have been exploited in the wild. Use both alongside your knowledge of the affected devices to inform prioritization.

Use one shared queue that still allows platform-specific filtering. Don't automatically put Windows first because you have more Windows devices or deprioritize Macs because another team "owns" them. A small group of Macs used for privileged administration may deserve attention before a larger, less-exposed Windows group, depending on the vulnerability and available evidence.

For the full prioritization framework, including when severity alone misleads you, the guide to prioritize CVEs goes deeper.

How do you remediate Windows and macOS vulnerabilities?

Choose remediation based on the affected application or operating system, the vendor's fix, and the deployment method available for that platform. This is where cross-platform visibility meets platform-specific execution.

For application vulnerabilities, review affected devices in PDQ, inspect the available remediation, select a compatible package, test it, and deploy. For findings with a recommended remediation package, you can automate deployment to devices running the vulnerable software version.

If the vendor has released a fix but there’s no matching Package Library package, a validated custom application package may be appropriate. If the vendor hasn’t released a fix, follow the mitigation workflow below.

What should you do when no patch is available?

When there's no fix yet, confirm applicability, follow vendor mitigation guidance, assign an owner, track remaining exposure, and revisit when a patch becomes available. CISA's KEV catalog includes vendor-guided mitigation and discontinuation instructions for relevant findings; sometimes the right response is discontinuing use rather than waiting for a patch.

Do not describe a temporary mitigation as completed remediation, and do not assume identifying a vulnerability guarantees an immediately deployable fix.

For the full packaging, testing, and rollout approach, the Windows and macOS patching playbook covers deployment rings and representative testing in detail.

How do you verify remediation on Windows and macOS?

Verify the resulting endpoint state against the vulnerability's remediation requirements, not just that a deployment was attempted. A deployment job completing successfully does not prove the exposure is gone.

1. Confirm the fixed version. Check the installed application version or OS build against the vulnerability’s remediation requirements.

2. Confirm required restarts or relaunches. Make sure devices have restarted or applications have relaunched where required to complete the update.

3. Refresh the vulnerability evidence. Review updated findings to confirm the endpoint meets the remediation requirements before marking the vulnerability as resolved.

Report results separately for Windows and macOS, as well as in aggregate. Use the same definitions and reporting window so that a strong Windows result does not obscure unresolved Mac findings, or vice versa.

Track offline devices awaiting updates, failed deployments, pending restarts, unavailable fixes, and approved exceptions separately from verified remediation. Use PDQ’s Ignore function for accepted risk, but don't use it as confirmation that a vulnerability is resolved.

For readers focused on measuring and improving remediation speed, the guide to reduce mean time to remediation covers that workflow.

One vulnerability management process for Windows and macOS

Managing vulnerabilities across Windows and macOS means applying the same standards to both platforms: accurate device data, risk-based prioritization, tested fixes, and verified results. Vendor advisories, deployment packages, and update requirements determine how you address each finding, while the process keeps your team accountable for resolving it.

PDQ brings Windows and macOS vulnerabilities into one view, so your team can investigate affected devices and prioritize findings without maintaining separate vulnerability workflows for each platform. From there, you can select, test, and deploy compatible Package Library or custom application packages. For findings with a recommended remediation package, you can automate deployment to devices running the vulnerable software version.

That shared workflow also gives you a starting point for operating system remediation. PDQ supports installing eligible Windows updates and reports macOS operating system vulnerabilities, with your MDM or another Apple update workflow handling macOS updates. Keep those Mac findings in the same remediation process, with an assigned owner and follow-up to confirm the fix.

Close the loop by checking the fixed application version or OS build, completing required restarts, and refreshing vulnerability evidence. Keep unresolved devices and accepted risks separate from verified fixes so your reporting reflects the work that remains.

PDQ connects vulnerability findings with deployment and reporting; that verification gives your team a clear answer to what matters across the fleet: which vulnerabilities are resolved, and which devices still need attention.