Queueing Analysis by Simulation of Risk Duration Prioritized Patch Scheduling Under Gated Windows

Patch hygiene remains uneven across small and medium-sized enterprises (SMEs) due to constrained staffing and tooling. At the same time, device heterogeneity spans information technology (IT), operational technology (OT), and consumer IoT estates. An interpretable triage-and-scheduling mechanism is presented for patch planning in heterogeneous IoT fleets under limited maintenance windows and limited parallel capacity. A Risk--Duration (RD) score ranks candidate patch actions by combining device criticality, exposure, and vulnerability age, optionally enriched with exploitation-aware signals (e.g., KEV membership and EPSS-like likelihood proxies), and normalizing by expected maintenance duration. The ranked backlog is executed under a window-gated scheduling discipline that enforces maintenance-window admissibility and per-window capacity limits, mitigates end-of-window surges, and bounds starvation for repeatedly examined but deferred items via deferral-count promotion. A discrete-event simulation (DES) is used to evaluate time-to-start tails, backlog-age tails, and per-window utilization under mixed-criticality workloads; window-adherence and end-of-window spike indicators are tracked for completeness. In a 56-day DES with 30 replications, the proposed RD+WGPS reduces the High-bucket KM P90 time-to-start tail from 305.2~h (FIFO) to 84.3~h and reduces $\overline{B95}$ from 6.14 to 1.42~days (S1); under low-capacity/high-heterogeneity conditions, it increases the High start rate to 0.69 (S3). The approach is compatible with mainstream change-management platforms and security governance frameworks, and can be implemented with minimal operational metadata.