Intelligence and advice powered by decades of global expertise and comprehensive coverage of the tech markets.
Published: 23 Jul 2026
July's Patch Tuesday from Microsoft was a real eye-opener for me. It blew away the record set for common vulnerabilities and exposures (CVEs) addressed by the monthly patch drop, with a total of 628 CVEs. And it occurred to me that this is the first strong signal of the effect that Mythos and the like will have on IT and SecOps teams.
Most of the attention thus far on models like Anthropic's Mythos, OpenAI's Daybreak, and Microsoft's MDASH goes to what they do: find vulnerabilities at a pace humans never could. Less attention goes to the downstream effect that those findings have on ops teams across all of IT. Every discovered vulnerability becomes a patch or remediation process, and someone still has to identify the machines that need it, deploy it and confirm the problem is actually gone.
What's more, even in a pre-Mythos world, organizations struggled with vulnerability management and patching. My own research shows the following:
The increase in quantity and frequency of OS updates and patches is the top reason why endpoint management has gotten harder in the past few years. The same type of increase in app updates and patches was also in the top 10, along with a greater number of managed devices, unmanaged devices and more.
Just 33% of organizations say they are "completely effective" at deploying and validating patches, and only 35% say they're completely effective at coordinating between security and IT teams.
The top vulnerability management challenge, by far, is aligning IT, security and operational teams.
And here's the thing: This data was collected in early 2025, before Mythos!
My next research project into this will surely update this data for the post-Mythos era, but for now, it serves as a giant warning flag. If IT teams found these things difficult before Mythos and the like, how can they have any confidence moving forward?
Still, you might wonder, what's the real effect of Mythos going to be? Surely there's a lot of hype, right? RIGHT?
The Mythos effect is already showing on Patch Tuesday
While there's undeniably a lot of extra attention being paid to these new models, there's also data that shows the downstream effects they're having on vulnerability and patch management. In June, we started to hear whispers of this through Microsoft's Patch Tuesday, and by July, that whisper turned into a full-on roar.
The following chart illustrates how the number of CVEs addressed by Patch Tuesday has compared over the years.
First, it shows Microsoft's own published counts of CVEs addressed by month from 2022 to 2026 via Microsoft Security Response Center. From 2022 to 2025, the number of CVEs patched through a typical Patch Tuesday was in the range of the gray, jagged area on the chart.
2026 is represented by the blue line and shaded area, and it started similarly to past years, with CVEs falling squarely within the averages until April (which, while above average, was not a record-setting month). We became aware of Mythos, Daybreak and MDASH between April and May, and by June, Microsoft had set a new record for the number of CVEs addressed on Patch Tuesday, with over 200. Then came July, with an astonishing 628 CVEs.
For context, consider the average number of CVEs per month for the past few years:
2022 monthly average: 78 CVEs.
2023 monthly average: 79 CVEs.
2024 monthly average: 91 CVEs.
2025 monthly average: 103 CVEs.
2026 monthly average (through 7 months): 209 CVEs.
What's interesting is that if you're just looking at individual patches, the uptick isn't nearly as dramatic. That's because multiple CVEs are rolled up into a patch. To see the downstream effect, we need to do some more light math and calculate the CVEs per patch ratio:
2024: ~1.9 CVEs per patch.
2025: ~2.2 CVEs per patch.
June 2026: 6.6 CVEs per patch.
July 2026: 9.2 CVEs per patch.
With this, we can see that each patch addresses four to five times more CVEs today than in the past.
All together, these are some troubling trends that are really going to put pressure on already-strained vulnerability and patch management teams, tools and processes. There are more vulnerabilities being fixed than ever before. Plus, this data is only from Microsoft. You can expect to see upticks like this from most, if not all, vendors.
And each patch from Microsoft is significantly more important, because each one addresses more of those vulnerabilities than in the past. Even if the CVEs addressed are low-severity patches for long-tail bugs, teams still have to sort through them and prioritize.
But wait, there's more
This is all looking pretty bad, and while there's a bit of hope that someday this will slow down once IT teams remediate all the vulnerabilities earlier in the software supply chain, there is another angle to focus on first: Every time a vendor posts its patches, it's a giant red flag for bad actors that shows exactly where the vulnerabilities are.
Historically, security teams had some time to prioritize CVEs and build a plan to remediate. Ops teams had a few days to get their deployment plans built and validated. But now, attackers can turn to autonomous tools to immediately try to exploit these vulnerabilities, which means the human-derived buffer we've enjoyed for the last 30 years has eroded away.
If you're keeping score, here's the breakdown:
Organizations were already struggling with vulnerability and patch management, such that it was the primary driver of difficulty in endpoint management, as well as a top-six challenge with endpoint security.
The number of vulnerabilities has gone up, along with the number of vulnerabilities addressed per patch.
The window to deploy newly released patches has gone down.
How can we deal with it?
To be clear, this is all correlation, not proof of the effect AI vulnerability detection is having. But I think the timing is hard to ignore. If you're with me, and you believe in fighting fire with fire, there is a light at the end of the tunnel.
Various companies have released products in the vein of autonomous endpoint management, though often using different terms, like autonomous workspace, autonomous patch management or autonomous IT. Adaptiva, Automox, Ivanti, ManageEngine, NinjaOne, Omnissa, Splashtop, Tanium and many others have built tools to help address the challenges that organizations are just starting to face.
The endpoint management side isn't the only one racing at this. Vulnerability management platforms (Tenable, Qualys, Rapid7 and others) are building AI-driven prioritization and remediation aimed at the same compressed window, just from the security side of the house. And given that aligning IT, security and operational teams was already the top vulnerability management challenge in my research, relief will need to come from both directions: machine-speed triage deciding what matters, and machine-speed deployment acting on it. The overlap means we can expect plenty of partnerships and competition, too.
Today, the tables have turned, and there is quite possibly more risk in delaying patches than there is in deploying them.
Broadly speaking, the autonomous platforms I'm talking about are a significant step up from the manual processes organizations have been using for years. Even the most sophisticated approaches of the past have been relying on automations that still require humans to make decisions on which patches to deploy to which machines. And that's where we are going to need help, because the answers are likely "all patches" and "all machines."
Historically, teams needed to wait while they built a plan and slowly executed it, validating every step along the way. That visibility gave administrators comfort and mitigated the risk of deploying patches that might cause issues. (Last month, I talked to an IT director who said they still have a three- to six-month wait time before they deploy patches, just in case. And this was not in an environment that demanded that kind of delay.)
Today, though, the tables have turned, and there is quite possibly more risk in delaying patches than there is in deploying them.
The manual or automated processes with built-in delays and checkpoints made sense in the past, when Patch Tuesday addressed tens of CVEs and attackers needed weeks to weaponize a disclosure. Neither of those is true anymore, and it changes the entire risk calculation.
Ask yourself: In a machine-paced world where vulnerability discovery and exploitation are both autonomous, what's more risky? Human-paced tools and processes that were already struggling to keep up, or autonomous tools that, properly configured and human-gated, can keep up with the new pace of vulnerability and patch management?
I know the CrowdStrike outage looms large for anyone who lived through it, and it's tempting to use it to demonize anything with "auto" in the name. But that incident wasn't born of autonomy. It was an automatic content update pushed to every machine at once, with no staged rollout and no human gate. In other words, it's an argument for human-gated autonomous tools, not against them. It's a cautionary tale for sure, but don't let it take your eye off the ball.
Conclusion
We're in for a big change in the vulnerability and patch management space. Thankfully, the vendors that provide tools have been thinking about this, and there is technology ready to meet those needs. The actual, measurable effects on the teams, tools and processes that are tasked with vulnerability and patch management remain to be seen, but it's an area that I pay close attention to, and one that I regularly conduct research into. While we wait to see the impact from the storm, at least we can prepare.
Gabe Knuth is the principal analyst covering end-user computing for Omdia.
Omdia is a division of Informa TechTarget. Its analysts have business relationships with technology vendors.
