“Orgs just need to patch faster”

Reality: Deploying a software security update is a response to someone else's defect. It's not a strategy, it's a tax.

The 2026 Verizon DBIR found median enterprise remediation time rose to 43 days, up from 32, with only 26% of known-exploited vulnerabilities remediated.

When the same defect classes recur year after year, the problem isn't that defenders are failing to deploy updates fast enough. It's that manufacturers face no consequence for shipping the defect in the first place.

Deploying updates should be the last resort, not the primary defense.

Discussion prompts

• If your team ships a fix for a recurring defect class, does anything change about how that class gets introduced in the first place, or does the cycle repeat next release?
• What would it take to show a reduction in the rate you publish updates to fix security defects?
• How can you prove to customers and operators that you've eliminated entire classes of coding error?