The most dangerous update is the one you never apply

Microsoft's November security release fixed more than 1,000 flaws, after more than 1,400 in October [1]. In 2025 the average was about 91 a month [2].

Microsoft puts the jump down to AI, which now finds flaws far faster than human researchers could [3]. That part is good news. Defenders are finding bugs before attackers do.

The hard part lands on whoever has to install the fixes.

When a month brought tens of fixes, many IT teams tested for up to 30 days before letting an update near production. That made sense while attackers took weeks to turn a flaw into an attack. They don't now. In a recent survey of 300 US security leaders, most believed an attacker could build a working exploit within three days [4]. Every week of testing is a week the door stays open.

It isn't 1,000 separate tests, though. Microsoft bundles its fixes into one cumulative update for each version of Windows. What has changed is how much each one carries: about two fixes per update in 2025, and more than nine by July 2026 [5]. Bigger updates touch more code, so more can break. That's what makes people nervous.

Nervousness about patching is nothing new. Many organisations equate change with risk. The more critical the service, the less likely anyone is to touch it. Updates get deferred, then skipped, until the system is years behind and nobody dares go near it.

I saw where that ends at a firm of about 600 people. Its Active Directory (AD), the system that controls who can sign in to what, was so old and poorly managed that it couldn't be repaired. The only workable option was to build a new one and migrate everything across. The backups had been failing, so there was nothing to recover to. And every PC shared one built-in administrator account, with a password unchanged in ten years. Microsoft's Local Administrator Password Solution (LAPS), which gives each machine its own rotating password, had never been set up. One stolen password would have opened every desktop in the business.

None of that happened in a day. It built up, one deferred change at a time.

Not patching is also a change. You just don't get to schedule it. An attacker does.

Patch testing in 2026: how larger organisations handle the volume

Their answer isn't more testing. It's faster, staged deployment with a way back:

• Rings. Updates go first to a small test group, then to a sample of real users, then to everyone. A common model tests for 24 to 48 hours, cut to a few hours when a flaw is under active attack [6].
• Rollback. For Windows, Microsoft can switch off a faulty change remotely using Known Issue Rollback [7]. Knowing you can undo a bad update makes it easier to install a good one quickly.
• Automation with a person approving. Tools handle deployment; people set the rules and sign off [5].

Patch management for SMEs: what to do this week

Here's my view, and some will disagree. Most SMEs never had a real 30-day test cycle. They had a delay. For a small firm, a staged rollout and a proven way back are that cycle.

• Pick a pilot group. A handful of people across different roles who get updates first and tell you quickly when something breaks.
• Treat exploited flaws as urgent. When Microsoft says a flaw is under active attack, the fix goes on within days, not at the next monthly window. Cyber Essentials already requires high-risk and critical updates within 14 days [8].
• Prove your backups restore. A copy you've never restored is a hope, not a plan.
• Switch on Windows LAPS. It's built into current versions of Windows at no extra cost.
• Know what you're running. You can't patch a server nobody remembers owning.

The question for your IT provider isn't "how long do you test?" It's "how quickly can you undo a bad update?" If they can't answer, that's the risk to fix first.

Read more

Sources

1. [1]The Register, November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far, 10 November 2026. https://www.theregister.com/security/2026/11/10/november-patch-tuesday-boasts-over-1000-bugs-but-only-one-zero-day-so-far/5308946
2. [2]NinjaOne, Rising Patch Tuesday counts, viewed 11 November 2026. https://www.ninjaone.com/blog/rising-patch-tuesday-counts/
3. [3]Hardware Busters, Microsoft's July Patch Tuesday is the biggest ever, July 2026. https://hwbusters.com/?p=109053
4. [4]AI Journal, Azul 2026 AI Vulnerability Gap Report, November 2026. https://aijourn.com/azul-2026-ai-vulnerability-gap-report-85-of-organisations-running-java-have-had-an-incident-suspected-incident-or-near-miss-due-to-slow-patching/
5. [5]TechTarget, Over 600 CVEs: Mythos' effect on vulnerability and patch management, 2026. https://techtarget.com/enterprise-software/opinion/Over-600-CVEs-Mythos-effect-on-vulnerability-and-patch-management
6. [6]Decryption Digest, Enterprise patch management best practices, 2026. https://www.decryptiondigest.com/blog/enterprise-patch-management-best-practices
7. [7]Microsoft, MC1183186: New resource on Known Issue Rollback (KIR), 5 November 2025. https://mc.merill.net/message/MC1183186
8. [8]IASME, Important update: changes to Cyber Essentials for April 2026, viewed 11 November 2026. https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/

All blog posts