Method, apparatus, and program product for autonomic patch risk assessment

An automatic risk assessment system is provided that determines a risk for the patch based on collected activity metrics, file weights, a list of files affected by the patch, and other factors. An application monitor collects metrics from the application to determine the level of activity of the application or other component to be patched. The patch may have associated therewith metadata including a list of files that will be affected by the patch. Policies may store information about how risk is to be assessed. This information may include, for example, file weights and information defining categories of risk.