Risk–Duration Score for Patch Prioritization in SME IoT Fleets

This paper presents a practical triage mechanism for planning IoT patches in small and medium-sized enterprises (SMEs). A Risk–Duration (RS) score combines device criticality, exposure, and vulnerability age, normalized by the expected maintenance window duration, to create a sequential queue. An inventory-driven workflow maps assets to RS values, creates priority groups, and applies a window-gated scheduling rule that aligns updates with existing service windows. Discrete-event simulations demonstrate reduced waiting times for high-impact patches and improved maintenance-window adherence without starving low-impact updates.