A vendor may publish a fix before it reaches every installation. Testing, staged rollout and systems that update infrequently can extend the period when some copies remain vulnerable.
People responsible for security can shorten that period by prioritizing important fixes, checking which systems received them and using temporary protections when immediate updating is impractical.
ELI5
A patch gap is the wait between having a fix and having that fix in the software people actually use. The old weakness can remain during that wait.
For example, developers may fix a browser problem today, while some users still run an earlier version. Those users have not yet received the benefit of the fix.
Does publishing a fix protect everyone immediately?
Protection usually depends on installing and activating the update on the affected system.
Why can patch gaps differ across organizations?
Update schedules, device access and testing requirements all affect how quickly an organization can apply a fix.
