On October 22, 2026, I hosted a Devicie webinar, Alerting is not the fix, with our Chief Executive Officer, Alex Hesterberg. The question I wanted us to work through was why spotting flaws isn't the hard part for most organizations, and why fixing them fast is what matters.
It fell in the middle of what security teams were already calling Black October. Here's what we covered, with a source for every number.
Microsoft set a Patch Tuesday record in September with 966 fixes, then broke it in October with 1,411 (BleepingComputer, September and October). Across all software, 48,185 vulnerabilities were published in 2025, a record, and the first half of 2026 ran nearly 50% ahead of the same period in 2025 (Trend Micro).
AI is part of the reason. One AI model flagged more than 23,000 potential vulnerabilities across more than 1,000 open-source projects, and of the first 1,900 that outside firms reviewed, 1,726 were confirmed (SecurityWeek). Microsoft expects the volume to keep rising: "customers will see a higher volume of security updates included in each security release" (BleepingComputer).
The time to apply fixes is shrinking. Mandiant's M-Trends 2026 report estimates the mean time to exploit at negative seven days, meaning exploitation on average starts before a fix is available (Security Boulevard). It is an estimate of an average, so individual flaws vary widely.
Deadlines are moving the same way. CISA's BOD 26-04, issued June 10, 2026, gives US federal civilian agencies three calendar days to remediate or mitigate the highest-risk exploited flaws, where newer exploited flaws generally used to get two weeks. It binds federal agencies only, though other organizations can adopt it voluntarily (Action1).
Vendors are shipping more often to keep up. Since July 14, Adobe has released security updates on the second and fourth Tuesday of each month, because "a once-a-month publication window is no longer fast enough to stay ahead of our adversaries" (Computerworld).
Alex's main message was that this goes beyond any vendor or product category:
"This is not a Devicie message. This is not an end user compute message. This isn't even a security message… The reality is we are seeing and finding vulnerabilities at a scale that is breaking records every single month."Alex Hesterberg, Chief Executive Officer, Devicie
He also pointed to shorter SLAs and more accountability for getting fixes rolled out:
"Those two realities of increased volume and threat, decreased amount of time to go deal with it, are the real… macro reality that we all have to embrace. It doesn't matter what industry you're in."Alex Hesterberg
On compliance and regulation:
"Layer in things like compliance, layer in things like additional regulations, depending upon what industry you're in, it just becomes that much more critical that speed, automation and trust are inherent in the partners you're working with, in the vendors you're trusting and working with."Alex Hesterberg
That means more versions to keep current, in less time, with auditors asking for proof. A monthly cycle or a one-off project doesn't keep pace with that, so device management has to run continuously.
Inside Microsoft Intune, Devicie keeps configuration in the agreed state, prepares and tests new versions of supported apps while your team controls the rollout, and reports both what is ready and what is installed. For how this applied during Black October, see Black October: what it means for your devices.
If you have a question about anything we covered, Alex and I will answer it personally: reach us at devicie.com/contact. We're planning more sessions, so tell us what you'd like covered too. And to see where your own environment stands today, start with a free Intune Health Assessment.
Request your free Intune Health Assessment
Steve Arlin is Senior Director, EMEA, at Devicie.