For years, patch management was relatively straightforward.

Microsoft released security updat

es, IT teams deployed them and businesses moved on to the next month.

That model is being challenged.

The number of vulnerabilities being discovered is increasing, AI is accelerating vulnerability research, and attackers are gaining the ability to identify and exploit weaknesses faster than traditional patching cycles were designed to handle.

For businesses, the question is no longer simply:

“Are our computers patched?”

It should be:

“Which vulnerabilities

 affect us, which present the greatest risk, and how quickly can we respond?”

The vulnerability management workload has changed

Microsoft's monthly Patch Tuesday provides a useful indication of the scale of the change.

Microsoft addressed approximately:

• 917 vulnerabilities in 2022
• 909 in 2023
• 1,009 in 2024
• around 1,150 in 2025

That was already a substantial workload for cybersecurity and IT teams.

During 2026, however, vulnerability reporting accelerated dramatically. Recent Microsoft security releases have involved vulnerability counts measured in the hundreds and, depending on the methodology used, more than a thousand in a single month.

In November 2026 alone, security researchers at Qualys reported that Microsoft addressed more than 1,200 vulnerabilities, including dozens rated Critical and a vulnerability already being exploited in

the wild.

Different security researchers use different methodologies when counting vulnerabilities and affected products, so headline numbers aren't always directly comparable.

But the underlying trend is clear:

Businesses and IT providers have considerably more vulnerability information to assess, prioritise and remediate than they did only a few years ago.

Why are we finding so many more vulnerabilities?

It doesn't necessarily mean software has suddenly become dramatically less secure.

An important part of the explanation is that we're becoming much better at finding weaknesses.

AI is accelerating vulnerability discovery

Microsoft is already applying sophisticated AI to vulnerability research.

Its MDASH initiative uses multiple specialised AI agents to analyse complex software including Windows, Hyper-V, Azure and identity systems.

Where vulnerability research traditionally relied heavily on specialist human researchers, AI increasin

gly allows software to be analysed systematically and at enormous scale.

For cybersecurity this is ultimately positive.

The sooner a vulnerability is discovered and fixed, the less time it can remain hidden inside widely used software.

But it creates a new operational problem.

Organisations need to process, prioritise and remediate a rapidly increasing volume of vulnerability information.

Attackers are accelerating too

Unfortunately, defenders aren't the only ones benefiting from AI.

Attackers are increasingly able to use AI and automation for reconnaissance, social engineering, malware development and elements of vulnerability research and exploit development.

Microsoft describes AI as changing the “physics of cybersecurity”, increasing the speed and scale at which both defenders and attackers can operate.

This compresses on

e of the most important cybersecurity measurements:

the time between a vulnerability becoming known and attackers being capable of exploiting it.

A patching strategy based purely on installing updates several weeks after their release increasingly carries risk.

For some vulnerabilities, particularly those affecting Internet-facing or business-critical systems, the appropriate response may be measured in hours or days rather than weeks.

How Vertech helps businesses manage vulnerability risk

At Vertech IT Services, we believe modern patch management needs to go further than simply checking whether Windows Update ran successfully.

Our approach brings together managed patching, specialist patch testing, endpoint management, vulnerability intelligence, firewall protection, security monitoring and cybersecurity expertise to help clients understand and reduce their actual exposure.

Security patches are tested before deployment

Installing every new security patch immediately is not necessarily good security practice.

Updates can introduce compatibility issues, application failures or unexpected operational problem

s. At the same time, waiting too long can leave a business unnecessarily exposed to vulnerabilities that attackers may already be attempting to exploit.

Vertech addresses this balance by using a specialist Network Operations Centre (NOC) as part of our managed patching service.

New security patches are reviewed and tested before being approved for general deployment. Our target is to have approved security patches deployed within seven days of release, substantially inside the one-month remediation timeframe recommended for many non-internet-facing systems in Australian Government cyber security guidance.

This provides an important balance:

Test first, but don't wait unnecessarily.

For businesses, this offers greater confidence that patches have been assessed before widespread deployment while still substantially reducing the window in which known vulnerabilities remain exposed.

Internet-facing systems need a different approach

Not every sy

stem should have the same patching priority.

A workstation protected behind multiple security controls presents a different level of exposure from a firewall, VPN gateway, Internet-facing server or other service directly accessible from the Internet.

The Australian Signals Directorate's patching guidance specifically recognises this distinction.

For online services and Internet-facing network devices and servers, the guidance recommends patching within two weeks under normal circumstances, accelerating to within 48 hours where vulnerabilities are rated critical by the vendor or working exploits exist.

For non-Internet-facing network devices, servers, workstations and many applications, the normal recommended timeframe is within one month, again with significantly faster remediation appropriate in high-threat circumstances.

That is why our approach doesn't treat patching as a single monthly process.

Protecting the network edge

Firewalls require particular attention because they sit directly at the boundary between a business and the Internet.

Where supported, the firewalls we manage therefore have on-the-fly hotfixing capabilities enabled, providing an

additional mechanism for rapidly protecting vulnerable Internet-facing services.

This is particularly important when a newly discovered threat demands a response much faster than the normal patch testing and deployment cycle.

The principle is simple:

The greater the exposure and likelihood of exploitation, the faster the required response.

Our vulnerability management approach

Identify

Understand the devices, software and vulnerabilities present across the business.

Assess

Determine the severity of each vulnerability, whether exploitation is occurring, what systems are exposed and what impact compromise could have.

Test

Use our speci

alist NOC capability to assess security patches before approving general deployment, reducing the risk of an update causing business disruption.

Deploy

Target approved routine security patches for deployment within seven days of release, rather than allowing vulnerabilities to remain open until the end of a monthly patching cycle.

Accelerate

Treat Internet-facing, actively exploited and other high-risk vulnerabilities differently. Where circumstances require it, use emergency patches, firewall hotfixes, mitigations or configuration changes rather than waiting for the standard deployment cycle.

Verify

Confirm that reme

diation has actually occurred and identify devices, applications or systems that remain vulnerable.

Report

Provide meaningful information about vulnerability exposure, outstanding risks and remediation rather than simply reporting that an update task completed successfully.

This creates a much more effective lifecycle:

Discover → Assess → Test → Prioritise → Remediate → Verify → Report

Good patch management is about managing the window of risk

The objective isn't simply to achieve a high patch-compliance percentage.

The real objective is to minimise the amount of time between a vulnerability becoming a credible threat and the business becoming protected against it, without introducing unnecessary operational risk through uncontrolled patch deployment.

That's why we differentiate between routine patching and urgent vulnerability remediation.

For a routine workstation security update, a controlled test-and-deploy process within seven days provides a sensible balance between security and stability.

For a critical vulnerability affecting an Internet-facing system where working exploits exist, seven days may be far too long. Australian Government guidance recommends action within 48 hours in these circumstances.

And when threat intelligence indicates that a vulnerability is already being actively exploited, the appropriate response may need to be even faster.

Patching is therefore not just a scheduled IT maintenance task.

It is an ongoing cybersecurity risk-management process.

The answer isn't simply “patch faster”

The increase in vulnerability discovery shouldn't cause businesses to panic.

In many respects, discovering more vulnerabilities is positive.

A vulnerability that is identified and fixed is preferable to one remaining undiscovered inside widely deployed software for years.

But the security environment is changing.

AI and automation are helping defenders discover vulnerabilities faster.

They're also helping attacker

s operate faster.

Trying to treat every vulnerability equally isn't scalable.

Waiting several weeks before responding to everything isn't safe.

And blindly deploying every update immediately isn't operationally sensible.

Businesses need risk-based vulnerability management that continuously identifies exposure, prioritises genuine threats, tests and automates routine remediation, and enables much faster intervention when circumstances demand it.

Is your patching strategy actually managing cyber risk?

If your existing IT or security report tells you that “98% of devices are patched”, that's useful.

But it doesn't answer the most important questions:

Which known vulnerabilities are still present?

Are any of them being actively exploited?

Are Internet-facing systems being treated more urgently than ordinary endpoints?

How quickly are new security patches assessed, tested and deployed?

And can 

your IT provider prove that remediation has actually occurred?

Those are the questions modern vulnerability management should answer.

Talk to Vertech about a Vulnerability & Patch Management Review

Vertech IT Services can review your current patching and vulnerability management approach and identify gaps in visibility, prioritisation, testing, remediation and reporting.

Our managed approach is designed around practical risk reduction:

• specialist NOC testing and approval of security patches
• a seven-day target for routine security patch deployment
• accelerated treatment of critical and actively exploited vulnerabilities
• rapid protection for Internet-facing infrastructure
• firewall hotfixing and additional mitigation where supported
• ongoing vulnerability identification and prioritisation
• verification that remediation has actually occurred
• reporting that focuses on security exposure rather than simply patch statistics.

Don't wait for an exploited vulner

ability to discover whether your patching process works.

Talk to Vertech IT Services about a Vulnerability & Patch Management Review and find out whether your current approach is keeping pace with today's cybersecurity risks.