Cybersecurity

Managed Patching Services: Keeping Up as AI Speeds Up Vulnerability Discovery

Reported vulnerabilities are climbing fast. Here is how to rethink patch windows, priorities and testing so your business stays ahead of attackers.

Security analyst holding a tablet in front of threat-monitoring screens while tracking vulnerabilities that need patching

By DESSS Security Team

Managed patching services give a business a provider that inventories its systems, tracks new vulnerabilities, tests updates and deploys them on a set schedule, with an emergency path for flaws under active attack. As AI tools find vulnerabilities faster, that discipline matters more than ever for firms that patch monthly or ad hoc.

Software flaws are being found faster than most small and mid-size businesses patch them. A monthly update night, or patching whenever someone remembers, was a workable habit when disclosures arrived at a slower pace. That pace has changed, and AI is a large part of the reason. This post explains what the numbers show, why a shrinking patch window matters and how a managed IT services partner can run patching as an ongoing process instead of a chore.

What Is Driving the Vulnerability Surge?

The vulnerability surge is driven largely by faster discovery. AI models can now read code, reproduce bugs and build test exploits far more quickly than human researchers working alone. More reported flaws means more patches to install, and attackers use similar tools, so the time between disclosure and exploitation is shrinking.

Reuters reported on November 5, 2026 that nearly 37,000 vulnerabilities were added to the CVE list, the public registry of disclosed security flaws, in the third quarter of 2026. That is roughly three times the figure for the same quarter a year earlier.

The same Reuters report described two PHP flaws found by AI and disclosed on October 21. Cloudflare said exploitation attempts climbed from thousands to millions within hours.

Also on November 5, OpenAI announced GPT-6 Cyber, a model tuned for finding and validating software vulnerabilities, with access limited to vetted security customers. According to OpenAI, as reported by The Register, researchers used it to find 81 previously unknown high-severity Firefox vulnerabilities, which Mozilla has begun fixing.

Defenders benefit too, because more bugs get found and fixed. The catch for an ordinary business is volume. Every fix still has to reach your servers, laptops, firewalls and line-of-business applications.

Close-up of blue-lit data center server racks that need regular security patches

Why Monthly or Ad Hoc Patching Falls Behind

Microsoft publishes its monthly security update on the second Tuesday of each month, widely known as Patch Tuesday, according to Microsoft's Windows release documentation. Microsoft also ships out-of-band updates when an issue cannot wait for the next cycle.

A fixed monthly rhythm is still a sensible baseline. The problem is everything outside it:

Third-party software. Browsers, PDF readers, VPN clients and accounting packages follow their own release schedules.
Network and edge devices. Firewalls, routers and remote access appliances are frequent targets and are easy to forget.
Out-of-band fixes. An emergency patch released mid-month can sit uninstalled for weeks if the next scheduled night is the only plan.
Ad hoc habits. When patching depends on one busy person, it slips during month-end close, travel or a staff change.

The patch window is the time between a fix becoming available and its installation on your systems. When exploitation can start within hours of disclosure, a window measured in weeks is a real exposure.

How Should a Business Prioritize Patches?

A business should prioritize patches by exploitability and exposure rather than severity scores alone. Fix flaws that are known to be exploited first, then those likely to be exploited soon, starting with internet-facing systems. Everything else follows the normal schedule after testing.

Start with the CISA KEV catalog

CISA's Known Exploited Vulnerabilities (KEV) catalog lists flaws confirmed as exploited in the wild. CISA advises organizations to use it as an input to their vulnerability management prioritization. If a KEV entry matches something you run, treat it as urgent.

Add EPSS for likelihood

The Exploit Prediction Scoring System (EPSS), maintained by a special interest group at FIRST, estimates the probability that a published vulnerability will be exploited in the next 30 days. Scores are refreshed daily. EPSS helps sort the long list of flaws that look serious on paper but are unlikely to be used.

Weigh exposure and business impact

A medium-rated flaw on an internet-facing remote access gateway can matter more than a critical one on an isolated test machine. Rank systems by what they touch, such as patient records, payment data, operational technology or the ERP that runs your warehouse.

The Building Blocks of a Patching Program

Asset inventory. You cannot patch what you do not know exists. A current list of devices, operating systems, applications and cloud services is the starting point.
Vulnerability scanning. Regular scans compare that inventory against new disclosures and confirm which fixes actually landed.
Risk-based scheduling. Routine updates follow a monthly cycle, while KEV-listed or high-likelihood flaws on exposed systems follow a faster track.
Testing before rollout. Updates go to a small pilot group first, so a faulty patch affects a few machines, not the whole office.
An emergency patching path. A pre-approved process for out-of-band fixes, including who can authorize a reboot during business hours.
Rollback plans. Backups or snapshots taken before major updates allow a quick recovery if something fails.
Monitoring and reporting. Dashboards show patch status by device, and exceptions are documented.

For servers, storage and network gear, this work fits naturally with infrastructure managed services, because the team that monitors those systems also schedules their maintenance windows.

Patching is one control among several. Systems that cannot be updated quickly, such as older equipment on a plant floor, need network segmentation, restricted access and closer monitoring. Recording those decisions is part of governance, risk and compliance work, and it is the kind of evidence auditors and cyber insurers tend to ask for.

For Houston organizations, the stakes vary by sector. Healthcare providers around the Texas Medical Center protect patient data, energy companies run operational technology that cannot reboot on demand, and logistics firms near the Port of Houston depend on systems that keep cargo moving. Each needs a patching plan that respects uptime as well as risk.

What to Ask Your IT Provider

Use these questions to check whether your current arrangement can keep up:

How often do you scan our environment, and can we see the results?
Do you patch third-party applications and network devices, or only Windows?
How do you use the CISA KEV catalog and EPSS scores to decide what to patch first?
What is your target time to patch a known exploited vulnerability on an internet-facing system?
How do you test updates before rolling them out to everyone?
What happens when an out-of-band fix is released mid-month?
How do you handle systems that cannot be patched?
What reports will we receive, and how often?

AI also creates risks inside your business, such as staff pasting data into unapproved tools. Our guide to shadow AI governance for small and mid-size businesses covers that side of the picture.

Key takeaways

Reported vulnerabilities have risen sharply, with Reuters citing nearly 37,000 CVEs in the third quarter of 2026.
AI tools speed up discovery for defenders and attackers alike.
Prioritize by known exploitation (KEV), likelihood (EPSS) and exposure.
Inventory, testing, emergency paths and monitoring make patching repeatable.

Frequently Asked Questions

What are managed patching services?

Managed patching services are an outsourced arrangement in which an IT provider keeps your operating systems, applications and devices updated. The provider tracks new vulnerabilities, tests patches, schedules deployment, handles emergency fixes and reports on what was installed. The goal is a consistent, documented process that does not depend on one person remembering to run updates.

Is patching once a month still enough?

Monthly patching is a reasonable baseline for routine updates, and it lines up with Microsoft's Patch Tuesday cycle. It is not enough on its own. Vulnerabilities known to be exploited, especially on internet-facing systems, need a faster track, and third-party software and network devices need attention outside the monthly window as well.

What is the difference between CVSS, EPSS and KEV?

CVSS rates how severe a vulnerability could be if exploited. EPSS estimates the probability that it will be exploited in the next 30 days. The CISA KEV catalog lists vulnerabilities already confirmed as exploited. Used together, they help a small team focus on the flaws attackers are actually using rather than chasing every high score.

How do you patch systems that cannot be taken offline?

Schedule short maintenance windows during low-activity periods and use redundancy so one node can update while another carries the load. Where a system truly cannot be patched, such as older industrial equipment, isolate it on its own network segment, restrict who can reach it, monitor it closely and document the decision and the compensating controls.

Put Patching on a Schedule You Can Trust

If patching at your business depends on spare time, it may be time for a different approach. DESSS can review how updates are handled today and help you build a process that fits your systems, as part of our wider cybersecurity consulting services.

Contact DESSS to start the conversation. Visit us at 2825 Wilcrest Dr #608, Houston, TX 77042, call +1-713-589-6496 or email info@desss.com.