- A Socura poll of 500 UK security leaders found 22% have tried to avoid Patch Tuesday; Socura blames more patches and rising stress.
- Microsoft fixed a record 974 CVEs in its September 2026 release, beating the previous record of 570 set two months earlier.
- Boards should ask who covers the patch cycle when the person who owns it is stretched, absent or burned out.
When a security leader books a holiday to miss one particular day, the calendar is telling you something about the system. The person is not the problem. One in five is a high share for a behaviour that rarely shows up in continuity planning, in our view. The argument here is that as vendors ship more fixes, patching becomes a people problem. The strain lands on whoever owns the monthly cycle.
What the poll found
Socura, a managed detection and response (MDR) specialist, polled 500 UK chief security officers, CISOs and heads of IT security. It asked about Patch Tuesday, the monthly date when Microsoft, Adobe and other vendors release their security updates.
A total of 22% said they have tried to avoid the date altogether. Infosecurity Magazine, which reported the results, describes this as calling in sick or deliberately booking time off. Meanwhile 41% said they have worked overtime to manage the cycle, and 37% said they have worked late to deploy patches.
The strain shows up in feelings as well as hours. Socura found that 29% feel "significant anxiety" the night before Patch Tuesday. Another 29% said that week leaves them shorter-tempered with colleagues or family.
Two limits apply. This is one poll of UK respondents, and Socura is a security provider with an interest in the case for more resourcing. The figures show how these leaders describe their own behaviour. They do not measure what happened to patching on those days.
Why more fixes means more human work
A vendor releasing a fix does not protect anyone. Protection comes later, after a team does the deployment work. In general, that means checking which fixes apply to the systems the company runs. It means testing them against business software, trying them on a small group first, and booking a change window. Some fixes also need a restart. Each step usually needs a person to approve it.
A bigger monthly batch means more items to sort, test and approve in the same window. Most of that effort is human time, not computing power. This is a general description of the process. The poll does not say how Socura's respondents run theirs.
Think of a loading dock sized for one truck a day. If ten arrive on the same morning, the dock does not fail evenly. The few people on shift carry the whole load.
How AI-assisted research raises the count
Infosecurity Magazine ties the rising workload to AI-powered vulnerability research, which helps vendors find software flaws in greater volumes. Each separate flaw gets its own CVE number, the standard identifier for a known vulnerability. Each flaw also needs its own fix. If research tools surface more flaws, more fixes and more identifiers land in the same monthly batch.
Microsoft's September 2026 update closed 974 CVEs, a record, according to the outlet. The previous record was 570, set two months earlier.
That is 404 more fixes than the earlier record. The report does not say how many of those flaws affect any given company. It does not say how many were serious. It also does not say how much of the total came from AI-assisted research. Still, more discovery upstream points to more deployment work downstream.
The strain predates this poll. A Seemplicity report from March 2026 found that 45% of cybersecurity leaders work 11 or more extra hours a week. It also found that 43% said time off creates a huge amount of stress when they return.
A single point of failure with a pulse
Here is what this shows. If the person who owns patching is anxious, overworked or deliberately absent, the monthly cycle has a single point of failure. That risk will not appear in a vulnerability scan. It may show up instead in how quickly fixes reach your systems.
AI may ease some of the load. In the same poll, 40% said AI automates mundane work and frees their teams for strategic tasks. Another 37% said it helps them protect core infrastructure against active threats. The poll does not say whether that relief matches the growth in patch volume.
Questions to put to your security team
Ask who covers Patch Tuesday week, and whether that cover exists on paper or in practice. Ask how many of each month's fixes apply to your systems, and how many can be deployed with little human effort. Ask which approvals wait on one named person.
Ask how many overtime hours the team logged in patch weeks over the past six months. That number is an early signal of risk. Finally, ask whether your resourcing was planned for 570 fixes in a month or for 974.
Socura's chief executive, Andrew Kays, argued that security teams must be "properly resourced on Patch Tuesday." Whatever one thinks of the vendor, the point stands. A control that depends on tired people being present on one particular day is only as strong as those people.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Infosecurity Magazine.
