Is Microsoft’s Patch Tuesday too big to tackle? In a word, yes

Prior to the monthly standard established then, Microsoft released patches and updates as needed, which made it difficult to plan around, particularly for busy IT departments.

And, of course, it grew. Just seven years later, one Patch Tuesday featured a whopping 49 vulnerabilities, which was touted by media outlets at the time as the “biggest ever” at the time, more than three times larger (shock! horror!) the previous month.

Fast forward to the most recent Patch Tuesday, and Microsoft dropped more than 1,400 patches – 42 per cent more than the month prior, in September, and eight times larger than the same period a year before.

And, according to NinjaOne’s APAC Director, MJ Robotham, we ain’t seen nothin’ yet.

"This is quickly becoming the new normal, and I don’t think we’re anywhere near the peak yet,” Robotham told Cyber Daily.

“Part of this is simply that there’s more software in the world than ever, and much of it sits on decades-old code that’s never been properly examined.”

VIEW ALL

The rising wave of vulnerabilities is so great that Microsoft’s looking at a new way to handle patching, talking about “risk cohorts” to make the job of triaging what to address and when an easier one to navigate.

“Each CVE still needs to be reviewed on its own merits, but many CVEs require analysts to answer the same questions about deployment, exposure, trust boundaries, and usage patterns,” Microsoft said in a recent blog post.

“Grouping CVEs around those shared questions can provide a more efficient starting point for analysis.

“We call these provisional groupings risk cohorts. They are an exploratory way to help customers organise their own analysis.”

They’re not official, do not change the company’s guidance, and do not replace CVEs. Rather, Microsoft calls them a “starting point, not a final decision”.

“Customers should continue to review each CVE for active exploitation, severity, attack vector, user interaction, and product-specific guidance,” Microsoft said.

The accelerant making every IT department’s life that much harder is – perhaps unsurprisingly – artificial intelligence, Robotham said.

“Vendors are now using AI to dig through that code and surface flaws at a pace that wasn’t possible a year ago, and attackers are using AI to their advantage too,” he said.

“On one hand, this means vulnerabilities are being found and fixed before they can be exploited. But it puts vendors like Microsoft on a real shot clock, and it puts enormous pressure on the IT teams who have to act on every update.

"The moment a patch is released, it’s essentially open season. Attackers know exactly where to look, and any system left unpatched goes straight to the top of their list.”

Robotham believes that monthly patch releases are no longer fit for purpose, and that 1,000-plus vulnerabilities reported each month is “becoming the norm rather than the exception”.

"The real issue is the cost of delay. Once a fix is out, every day it sits unapplied is another day of exposure,” he said.

“It’s near impossible for any team to work through more than a thousand fixes a month by hand. The organisations that come through this will be the ones using automation to work out which patches matter most to their environment, and getting them applied quickly and safely.”