Another update notification. Another maintenance window. Another request to restart your computer.
Security updates are a familiar part of running a business, but the number of vulnerabilities being reported in 2026 helps explain why keeping systems current is receiving so much attention.
Microsoft’s 2026 Digital Defense Report says nearly 40,000 CVEs were published in the first half of the year. A CVE is a reference number used to identify a publicly disclosed security vulnerability. These records cover products across the software industry, not just Microsoft. Microsoft Digital Defense Report.
That does not mean your computer needs 40,000 updates. A single update can fix multiple vulnerabilities, and many affect products your business does not use.
But it does point to a change in how quickly security weaknesses are being found—and how much work goes into addressing them.
More fixes do not necessarily mean software is getting worse
It is understandable to see a long list of security fixes and wonder why the software had so many problems in the first place.
However, the number of vulnerabilities disclosed is not a straightforward measure of whether a product is becoming less secure. It also reflects how thoroughly people are looking for weaknesses.
Microsoft says AI is helping it examine more Windows code and identify issues faster. As a result, customers should expect more security fixes within each release. That is different from necessarily receiving more separate updates or restart requests. Microsoft’s explanation of AI-powered vulnerability discovery.
Some of the weaknesses being discovered may have existed for years. Finding and fixing them gives businesses a chance to close gaps that would otherwise remain hidden.
AI is helping researchers find those weaknesses
Security researchers have used automated testing tools for many years. AI is expanding what those tools can do and how much software they can examine.
One example is Microsoft’s MDASH, a system that combines multiple AI models to help researchers identify and validate potential vulnerabilities.
Microsoft reported that MDASH helped researchers discover 16 vulnerabilities addressed in its May 2026 security release, including four rated Critical that could allow an attacker to run code remotely. Microsoft’s MDASH research.
The useful development here is the ability to examine complex software more extensively, then give engineers findings they can investigate and fix.
It still requires validation. A suspected weakness is not automatically an exploitable vulnerability, and a proposed fix still needs testing.
Attackers can benefit from the same progress
The defensive opportunity comes with an obvious complication: attackers can also use increasingly capable AI tools.
In September, Anthropic published research showing that Zhipu AI’s GLM-5.3 model could build sophisticated cyber exploits autonomously in its evaluations. Anthropic compared those capabilities with its own Claude Mythos Preview model, announced earlier in the year. Anthropic’s GLM-5.3 assessment.
That does not mean every newly disclosed vulnerability immediately becomes a working attack. Results from controlled evaluations are not a prediction of what will happen to every business.
It does mean defenders need to take the possibility of faster exploitation seriously.
Sophos has warned that AI-assisted exploit development could further shorten the time businesses have to respond after a vulnerability becomes public. Its concern is the growing gap between how quickly weaknesses can be discovered and how quickly organisations can fix them. Sophos on the vulnerability flood.
For a business, the practical question is whether someone is reviewing those risks and acting when an important fix becomes available.
The computer on your desk is only part of the picture
Windows update notifications are visible. Updates for equipment sitting in a cupboard or server room are easier to overlook.
Firewalls, routers, network controllers, NAS devices and remote-access systems all run software. They need ongoing maintenance too.
Sophos highlights unpatched and unsupported network devices as a particular concern, especially where they are exposed to the internet. These systems can provide attackers with an entry point even when staff computers are well maintained. Sophos’s analysis.
A firewall that still passes internet traffic is not necessarily a firewall that is still receiving security fixes.
The same applies to an old storage device or remote-access appliance. “It still works” tells you something about its functionality. It tells you much less about its security.
Good patch management needs judgement
Automatic updates are useful, but businesses also need to know which systems are covered, whether updates have installed successfully and what still needs attention.
An update waiting for a restart may not have finished applying. A device that has been offline may have missed its maintenance window. Older equipment may no longer have a supported update available.
There is also the question of urgency.
A vulnerability being actively exploited in an internet-facing system may need attention much sooner than a lower-risk issue on an internal device. Critical business applications may need compatibility checks and a recovery plan before changes are made.
The aim is timely updates, with testing and monitoring proportionate to the risk. Microsoft similarly recommends assessing exposure, prioritising important systems and validating deployments as part of staying current. Microsoft’s patch-management guidance.
Testing should support a decision about when and how to update. It should not become a reason to postpone security fixes indefinitely.
What this means for small businesses
You do not need to follow every vulnerability announcement or understand every technical advisory.
You do need a clear answer to a few practical questions:
- Who is responsible for keeping each system updated?
- Are failed updates and pending restarts being followed up?
- Does maintenance include network equipment and remote-access systems?
- Is any equipment still in use after security support has ended?
- Can urgent security fixes be handled outside the normal maintenance cycle?
These are useful questions to ask your IT provider, even if everything appears to be working normally.
At Rabbit MSP, we monitor the systems we manage, review relevant security advisories, maintain supported operating systems and infrastructure, and investigate problems following updates.
That ongoing attention is an important part of managed IT support. It helps turn a stream of technical announcements into practical decisions about the systems your business actually uses.
Finding more vulnerabilities gives defenders an opportunity to improve security. Businesses benefit when the relevant fixes reach their systems.
If you are unsure whether your computers, servers or network equipment are being kept current, contact Rabbit MSP to discuss your setup.