Most enterprise patching programs were built for a different era. Ten years ago, keeping Windows current eliminated a meaningful portion of enterprise risk. Today, the operating system is just one piece of a much larger software ecosystem that includes browsers, collaboration platforms, document readers, VPNs, remote access tools, developer utilities, and hundreds of other third-party applications. Attackers adapted to that reality years ago. Many organizations haven’t.
According to Verizon’s 2026 Data Breach Investigations Report, vulnerability exploitation was involved in 48% of breaches, making it one of the most common initial access vectors.¹ Meanwhile, software outside the operating system shows up again and again in CISA advisories, the Known Exploited Vulnerabilities Catalog, and high-profile breach investigations involving file transfer platforms, remote access software, and other third-party technologies.²³⁴ The attack surface didn’t disappear. It shifted.
The problem isn’t just that there are more vulnerabilities. It’s that we’re discovering them faster than most organizations can remediate them. AI-assisted security research is accelerating vulnerability discovery, but infrastructure teams are still constrained by the same internal workflows and manual processes they’ve relied on for years. Organizations are getting better at finding exposure. Attackers are getting faster at exploiting it. Too many patching programs are still operating on timelines built for a pre-AI threat landscape.
The Iceberg Beneath Patch Tuesday
Most organizations measure patching success by looking at Windows compliance. Green dashboards. Healthy endpoints. Current cumulative updates. Those metrics matter. They just don’t tell the whole story.
The modern enterprise isn’t protected by Windows alone. It’s protected by hundreds of applications running on top of it: browsers, collaboration tools, PDF readers, VPN clients, password managers, developer tools, line-of-business software, and everything else employees install to do their jobs. Windows updates follow a predictable schedule with mature deployment tools and reporting. Third-party applications don’t. Every vendor ships on its own timeline, uses its own installer, requires its own testing, and often belongs to nobody in particular.
That’s the iceberg. A device can be fully compliant from a Windows perspective while still running multiple applications with known exploitable vulnerabilities. Your dashboard says it’s healthy. An attacker sees something very different.
Attackers Follow the Path of Least Resistance
My black hat counterparts don’t care whether they’re exploiting Windows, Chrome, Acrobat, or your VPN client. They care about one thing: which target gives them the highest return for the least amount of effort.
As Windows became harder to attack, they moved on. Third-party applications are patched on different schedules, packaged differently, tested differently, and often owned by nobody in particular. Chaos is good for attackers.
Lack of awareness isn’t the issue. Every security team knows third-party software is risky. The problem is that discovering vulnerable software takes minutes. Packaging, testing, approvals, and deployment take days, weeks, even months. That’s where attackers make up the difference.
Security’s New Scaling Problem
Over the last two decades, the cybersecurity industry made enormous investments in visibility. Vulnerability scanners became more sophisticated, asset inventories became more accurate, threat intelligence became more accessible, and organizations gained significantly better insight into the software running across their environments.
By some measures, those investments paid off.
Most enterprise organizations can identify vulnerable software more efficiently than they could ten years ago, but detection and remediation are not the same animal.
Meanwhile, AI-assisted security research is accelerating vulnerability discovery. Infrastructure teams, however, still have the same staffing, maintenance windows, and deployment processes they had a few years ago. When you can discover vulnerabilities twice as fast but can’t remediate them any faster, the backlog isn’t a temporary problem. It’s your operating model.
The Wrong Metric
Windows compliance is still important. Nobody is arguing otherwise. But if your patch management strategy begins and ends with operating system updates, you’re measuring the easiest part of the problem, not the part attackers care about most.
Organizations don’t reduce risk by producing greener dashboards. They reduce risk by shrinking the time between discovering a vulnerability and updating the software. That means automating packaging, reducing testing friction, simplifying deployments, and treating third-party applications as a core part of the security program rather than an afterthought.
The iceberg isn’t getting smaller. It’s getting larger. The organizations that adapt won’t be the ones that discover the most vulnerabilities. They’ll be the ones that can remediate them before somebody else takes advantage of them.
Closing the Gap
This problem doesn’t go away with another scanner to doomscroll. The solution is removing the friction between finding a vulnerability and deploying the fix.
That’s where automation changes the equation.
Patch My PC works alongside Microsoft Intune, Configuration Manager, and WSUS to automate the packaging and deployment of third-party application updates. Instead of spending hours rebuilding packages and chasing installers, endpoint teams can automate repetitive work while designing deployment rings and rollout schedules that fit their environment, getting updates into production before attackers can reverse-engineer the patch.
Visibility matters, too. Patch My PC Advanced Insights provides compliance reporting for supported third-party applications, making it easy to see what’s current, what’s vulnerable, and where remediation has stalled. Better visibility leads to better deployment decisions. Less time building spreadsheets. More time reducing risk.
The organizations that succeed over the next decade won’t be the ones that find the most vulnerabilities. They’ll be the ones that can consistently move updates from discovery to deployment before attackers have a chance to move first.