An electronic device comprising: an output device; a memory configured to store at least one source code and a comparison file including a correction and a vulnerability into which each of at least one character string included in a patch file corresponding to the at least one source code is classified; and a processor operatively coupled to the memory and the output device, wherein the processor is configured to: load the at least one source code stored in the memory, compare at least one first character string of the correction included in the comparison file corresponding to the at least one source code with a second character string included in the at least one source code and identify a first match rate based on comparing the at least one first character string and the second character string, compare at least one third character string of the vulnerability included in the comparison file with the second character string and identify a second match rate based on comparing the at least one third character string and the second character string, and provide at least one of information indicating whether the at least one source code has been patched, a probability that the at least one source code has been patched, or information about a vulnerability in the at least one source code through the output device based on at least one of the first match rate or the second match rate. an output device; a memory configured to store at least one source code and a comparison file including a correction and a vulnerability into which each of at least one character string included in a patch file corresponding to the at least one source code is classified; and a processor operatively coupled to the memory and the output device, wherein the processor is configured to: load the at least one source code stored in the memory, compare at least one first character string of the correction included in the comparison file corresponding to the at least one source code with a second character string included in the at least one source code and identify a first match rate based on comparing the at least one first character string and the second character string, compare at least one third character string of the vulnerability included in the comparison file with the second character string and identify a second match rate based on comparing the at least one third character string and the second character string, and provide at least one of information indicating whether the at least one source code has been patched, a probability that the at least one source code has been patched, or information about a vulnerability in the at least one source code through the output device based on at least one of the first match rate or the second match rate. load the at least one source code stored in the memory, compare at least one first character string of the correction included in the comparison file corresponding to the at least one source code with a second character string included in the at least one source code and identify a first match rate based on comparing the at least one first character string and the second character string, compare at least one third character string of the vulnerability included in the comparison file with the second character string and identify a second match rate based on comparing the at least one third character string and the second character string, and provide at least one of information indicating whether the at least one source code has been patched, a probability that the at least one source code has been patched, or information about a vulnerability in the at least one source code through the output device based on at least one of the first match rate or the second match rate.