In July 2026 Microsoft shipped fixes for 570 security vulnerabilities in a single Patch Tuesday - close to triple the previous month, which had itself set a record. August followed with another 398. That volume is not a sign that Windows suddenly got worse. It is what happens when you point AI at a very large codebase.
Alongside the flood of patches came new advice: stop treating a one or two week soak period as prudent, and get security updates deployed within about three days. For businesses used to a monthly maintenance window, that is a significant change in expectations.
Why the Numbers Exploded
On 9 July 2026, Pavan Davuluri, Microsoft's Executive Vice President for Windows and Devices, set out the reasoning on the Windows Experience Blog. Microsoft is running an internal system it calls MDASH - a multi-model agentic scanning harness - which uses several AI models, including third-party vulnerability discovery systems, to scan binaries at scale. Candidate findings are put through a multi-model debate process to strip out false positives before a human engineer ever sees them.
Microsoft's framing is that a higher patch count is good news: the fastest way to reduce customer exposure is to find the issues before attackers do. The company has also been explicit that customers should expect update volumes to keep trending upwards for some time.
Microsoft is not doing this alone. It is one of roughly fifty organisations - alongside Google, Cisco, CrowdStrike and Palo Alto Networks - evaluating Anthropic's Claude Mythos Preview model under Project Glasswing, an initiative aimed at finding vulnerabilities in systemically important software. Anthropic reported that the programme surfaced more than 10,000 high or critical severity vulnerabilities in roughly its first month of operation.
The uncomfortable corollary is obvious. The same class of capability that finds bugs at this rate can, in the wrong hands, be used to build exploits at a similar rate.
What Microsoft Is Actually Recommending
The practical guidance was spelled out by Microsoft 365 director Jeremy Chapman via Microsoft Mechanics. In short:
- Quality update deferral of fewer than three days, replacing the traditional one to two week soak.
- Update deadlines of zero to one day once an update is offered.
- Configured through Windows Autopatch, Microsoft Intune, Configuration Manager or WSUS, depending on what you run.
- Use hotpatching where it is available, to cut the number of reboots that fast patching would otherwise force.
- Use the optional preview ("D") releases, which ship roughly two weeks before the monthly security update, for compatibility testing.
The Pushback Is Reasonable
Independent experts have broadly accepted Microsoft's diagnosis while questioning the prescription. Scott Caveza of Tenable has argued that relying blindly on auto-updates without contextual validation is not a defensible security posture. Jeff Williams of Contrast Security has called a blanket three-day requirement neither realistic nor safe for most large organisations. Caitlin Condon of VulnCheck makes the sharpest point: effort should concentrate on vulnerabilities with functional proof-of-concept code and verified exploitation, not on all 398 of them equally.
There is a practical objection too. A patch that breaks a line-of-business application at 8am on a Monday is its own outage, and for a business with one server and no test environment, that risk is not theoretical.
Meanwhile the industry is moving in the wrong direction. Verizon's 2026 Data Breach Investigations Report found the median time to deploy a patch has increased to 43 days. The gap between 43 days and three days is not a tuning exercise; it is a different operating model.
A Workable Policy for an Australian SMB
Three days across the board is the wrong goal for most small businesses. Tiering by exposure is the right one:
Internet-facing and identity systems first. Firewalls, VPN and RDP gateways, mail gateways, public websites and CMS platforms, Microsoft 365 and Entra ID. Days, not weeks. Anything appearing on the CISA Known Exploited Vulnerabilities catalogue is an immediate job, whatever the calendar says.
User endpoints on automatic. Most SMBs have no meaningful patch testing capability, which means deferring updates buys risk without buying assurance. Autopatch or Intune with a short deferral, a one day deadline and a sensible reboot grace period is genuinely the safer option.
Line-of-business servers get a pilot ring. One non-critical machine patches first, the rest follow a few days later. Use the preview release to test compatibility ahead of the monthly rollout.
Verify your backups before you speed anything up. Fast patching is only safe if rollback is real. Test a restore.
Maintain an asset inventory. You cannot patch in three days what you do not know you own - and unmanaged plugins, appliances and forgotten test sites are where these incidents usually start.
Why This Is Not Hypothetical
July gave us a clean worked example outside the Microsoft ecosystem. The wp2shell vulnerability chain in WordPress core went from patch release on 17 July to confirmed in-the-wild exploitation by 21 July and public exploit code by 22 July. Five days. A business on a monthly patch cycle would have spent three weeks exposed to a fully weaponised, unauthenticated site takeover.
Microsoft's three-day figure may be too aggressive to apply universally, but the direction it points in is not in dispute. The old assumption - that there is a comfortable buffer between disclosure and exploitation - no longer holds.
References
- Pavan Davuluri, Microsoft, Evolving Windows vulnerability management to meet the speed of AI-powered discovery, Windows Experience Blog, 9 July 2026.
- Microsoft Mechanics, Deploy Windows updates to counter AI-discovered threats, Microsoft Community Hub.
- CSO Online, Microsoft's 3-day patching directive comes with added operational risk, 23 July 2026.
- Krebs on Security, Microsoft Patches a Record 570 Security Flaws, 14 July 2026.
- Tenable, Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs, 11 August 2026.
- Anthropic, Project Glasswing: An initial update.
- Help Net Security, Anthropic: Claude Mythos identified 10,000+ software flaws, 26 May 2026.
Verizon, Data Breach Investigations Report, 2026 edition. - CISA, Known Exploited Vulnerabilities Catalog.