Computerworld declares that the era of patching is over, arguing for risk-based prioritization rather than patching everything

On October 22, 2026, Computerworld published an article arguing that "the patch apocalypse is here," contending that the traditional model of patching everything on a fixed cadence is no longer sustainable and that organizations should shift to risk-based automated deployment. The article's stated background: nearly 48,000 CVEs were published in 2025, and the average time to exploitation has shrunk to about 5 days. It advocates prioritizing by risk rather than volume, addressing first the vulnerabilities in high-value assets that are being actively exploited and are reachable from the internet, and delegating browser patches, common third-party applications, and standard OS cumulative updates to automated staged deployment. The article also recommends running a tabletop exercise before the next emergency disclosure, noting that the bottleneck is often not the patching tools but incomplete asset data, unclear ownership, and slow handoffs between IT and security teams. This view is currently put forward in a single Computerworld report, with no subsequent developments of fact.

AI-generated from public reports

1. Oct 22· 1 reports

   Computerworld argues that the era of patching everything is over, advocating risk-based prioritization over patching everything

   Source:Computerworld