Topic starter
23/10/2026 12:46 am
TL;DR: September 2026 brought 995 Microsoft patches, 119 critical vulnerabilities and two actively exploited zero-days, according to Action1, but the real issue is that discovery and exploitation are outpacing the capacity to assess, prioritise and safely remediate them. Risk-based remediation now matters more than calendar-driven patch cycles.
Editorial analysis by NHI Mgmt Group, based on content published by Action1: “Nearly 1,000 Patches in a Month: Why the Old Patching Model Is Breaking Down”.
By the numbers:
- September 2026 delivered 995 Microsoft patches, including 119 Critical vulnerabilities and two actively exploited zero-days, according to Action1.
- CrowdStrike reported that 88% of exploitation involving vulnerabilities with public proof-of-concept code occurred within 48 hours of PoC release, according to Action1.
Key questions
A: A software flaw becomes more dangerous when the impacted system can reach privileged accounts, tokens, or secrets stores, because attackers can convert one foothold into broader access.
Q: What are the warning signs that patch prioritisation is failing?
A: The clearest signs are a backlog dominated by critical flaws, repeated exceptions for internet-facing assets, and remediation orders that ignore where privileged data or admin reach actually sits.
Q: What breaks when organisations rely on calendar-based patching for high-volume releases?
A: Calendar-based patching breaks when vulnerability disclosure and exploitation move faster than the next maintenance window.
Practitioner guidance
- Define risk-based remediation tiers Classify assets by exposure, business criticality and privilege so that patch urgency reflects blast radius rather than release size alone.
- Separate identity systems from standard maintenance queues Create a distinct approval path for identity infrastructure, privileged platforms and systems whose compromise would expand access across the environment.
- Measure remediation latency in three points Track the time from disclosure to environmental identification, from identification to decision, and from decision to mitigation or patch.
Bottom line: Record patch volume is only part of the problem, because the harder issue is deciding what matters first when vulnerability discovery accelerates.
Glossary terms: Risk-Based Remediation, Remediation Latency, Blast Radius, Continuous vulnerability governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Patch velocity is no longer the control that matters most. When disclosure outpaces testing and deployment, the decisive governance question becomes which systems can safely wait and which cannot. That shifts the centre of gravity from monthly patch cadences to risk acceptance, asset criticality and business dependency.
A few things that frame the scale:
- Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should security teams decide when to mitigate instead of patching immediately?
A: Use mitigation when the deployment risk is higher than the temporary exposure and when compensating controls can reduce the chance of exploitation. That decision should be pre-authorised for critical services, based on asset class, exposure, and the operational cost of downtime. The goal is not to avoid patching, but to choose the safest sequence under pressure.
👉 Read our full editorial: Why record patch volumes are breaking the old remediation model
This post was modified 6 days ago by NHI Mgmt Group