What is patch management?
Patch management is the routine of keeping software updated across a fleet: knowing what is installed, deciding which updates apply and when, rolling them out in stages, and verifying they actually installed. The verification step is the one that separates a process from a checkbox, because updates fail silently all the time.
Why it is harder than "turn on auto-update"
Auto-update tells you nothing when it fails, and it fails for boring reasons: full disks, machines that hibernate instead of rebooting, stuck update services. A patch process needs the report that says which machines are behind, and a way to fix the stragglers remotely. Reboots are the other half: an update that is installed but waiting on a restart is not protecting anyone.
A workable small-fleet policy
Security updates within days (staged: a pilot group first, everyone else after a week without incident), feature upgrades on a schedule you choose rather than the vendor's, and a monthly report of machines more than 30 days behind, each with a reason and an owner.