Editor's note: Originally published August 12, 2024. Updated October 16, 2026, to reflect the 2026 Verizon Data Breach Investigations Report, which ranks vulnerability exploitation as the leading cause of breaches, and to add the contract and compliance requirements that now govern patching timeframes.
TL;DR
- Exploited vulnerabilities caused 31% of breaches in the 2026 Verizon DBIR, now the top entry point.
- Contracts and standards require timely patching: NIST SP 800-171, PCI DSS, and federal CISA directives.
- Patch failures trace to ownership, asset visibility, and exceptions, not technology.
- Executives need five answers from IT. Most organizations cannot produce them on request.
System updates are a governance decision. Every delayed patch is a risk someone accepted, usually without the authority or the information to accept it.
Attackers know this. They scan for known flaws within hours of public disclosure, and they target the organizations slowest to close them. For executives, the question is no longer whether IT applies updates. The question is whether the organization can prove it applies them on time, across every system, with documented exceptions.
That proof drives contract eligibility, cyber insurance terms, and liability after a breach.
Unpatched Vulnerabilities Are Now Considered a Top Breach Entry Point
For the first time in the report's history, the 2026 Verizon Data Breach Investigations Report ranks vulnerability exploitation as the leading way attackers get in.
The volume problem compounds the risk. Verizon tracked roughly 68.7 million vulnerability instances in 2022 and 527.3 million in 2025, nearly an eightfold increase. Internet-facing devices such as VPNs, firewalls, and remote access tools draw the most attacks, and AI now compresses the time from disclosure to exploitation from months to hours.
A quarterly patch cycle no longer matches the threat. Leadership sets the cadence. Source: SC Media, Security Info Watch.
Contracts and Standards Set the Patching Clock
Timely patching is a written obligation in the frameworks that govern federal contracts, payment data, and cyber insurance.
Assessors test evidence, not intent. A policy that says "patch promptly" without defined timeframes, scan records, and approved exceptions does not satisfy any of these requirements. Cyber insurers apply the same scrutiny at renewal and after a claim.
Updates Also Protect Uptime, Performance, and Data
Security drives the urgency. Operational returns justify the discipline.
- Performance and stability. Updates fix defects that cause slowdowns, crashes, and unplanned downtime.
- Compatibility. Current systems keep working with vendor platforms, cloud services, and customer integrations. Outdated software loses vendor support and stops receiving fixes.
- New capabilities. Updates add features and encryption improvements the organization has already paid for.
- Data protection. Tested backups before major updates make any failed deployment recoverable within hours, not days.
Each outdated system adds cost: lost productivity, emergency support, and replacement on someone else's timeline.
Patch Programs Fail in Five Places
Automatic updates cover laptops. They rarely cover the systems attackers target first.
- Incomplete asset inventory. Teams cannot patch servers, cloud workloads, or network devices they do not know exist.
- Edge devices overlooked. Firewalls, VPN appliances, and remote access tools often sit outside the standard update cycle.
- Exceptions without expiration. Legacy applications earn a temporary pass that becomes permanent.
- Third-party software drift. Browsers, plugins, and open-source libraries update on their own schedules, outside central control.
- No executive owner. IT applies patches. No one is accountable for the risk when they slip.
Five Questions to Ask Your IT Leader
These questions separate a documented patch methodology from a hopeful one. Ask for evidence, not assurances.
- What percentage of our assets appear in the current inventory, including cloud and network devices?
- What are our written remediation timeframes for critical, high, and known-exploited vulnerabilities?
- How many critical vulnerabilities are open today, and how many are past due?
- Which systems hold patching exceptions, who approved them, and when do they expire?
- When did an independent party last validate our results?
If any answer takes more than a day to produce, the organization carries risk leadership cannot see.
Sera Brynn Tests What Your Patch Reports Claim
Since 2011, Sera Brynn has assessed and advised organizations that answer to federal contracts, payment card standards, and regulators. We test whether your systems match your reports.
As an Authorized C3PAO, our assessors evaluate flaw remediation controls the way independent assessors do.
Know Your Exposure Before an Attacker Does
A vulnerability assessment shows which flaws sit open in your environment today and which ones matter most. Talk with a Sera Brynn advisor about scoping one.
Connect with us: 877.701.8000
Frequently Asked Questions
Why is updating computer systems necessary for a business?
Updates close known security flaws. Exploited vulnerabilities caused 31% of breaches in the 2026 Verizon DBIR, the largest single entry point. Updates also keep the organization eligible for contracts and insurance that require timely patching.
How often should a business apply security patches?
Set timeframes by severity. PCI DSS requires critical patches within one month of release. Known-exploited vulnerabilities warrant action within days. Document the timeframes and measure against them.
Does NIST SP 800-171 require patch management?
Yes. Control 3.14.1 requires organizations to identify, report, and correct system flaws in a timely manner. Assessors look for defined timeframes, scan evidence, and documented exceptions.
Are automatic updates enough?
No. Automatic updates cover operating systems and common applications. Firewalls, VPN appliances, servers, and custom software often require manual testing and deployment.
Who should own patch management?
IT executes patching. A named executive owns the risk, approves exceptions, and reports status to leadership. Organizations without a full-time CISO often fill that role with a fractional CISO.
