August's Patch Tuesday was the second largest on record: 398 CVEs resolved, 42 of them rated Critical. One was confirmed exploited in the wild. Two more had been publicly disclosed before a patch existed.
The industry reads a month like that one way. Exploitation is getting faster, the window is closing, everybody must patch sooner. Some of that is true. Almost none of the cost lands there.
The number that hurts is 398, not 1
A security team's real constraint is not how quickly it can push one urgent patch. It is how many findings it can carry before triage quietly stops happening. Four hundred advisories in a month, against an estate of a few thousand hosts and a few hundred services, is not a patching problem. It is a sorting problem, and sorting is the part nobody funds.
I spent the last stretch of my career building an engine that decides whether systems are hardened. The lesson that surprised me was not technical. It was that a finding nobody can act on is worse than no finding at all, because it teaches the operator to scroll past the list. Volume erodes exactly the attention the volume was meant to attract.
Rank by reachability, not by severity
CVSS scores a vulnerability in the abstract. Your estate is not abstract. Four questions reorder a list faster than any scanner setting:
- Is the vulnerable code path reachable in the configuration you actually ship, or only in one the vendor documents?
- Is the service exposed, or does something in front of it already terminate the attack?
- Does a working exploit exist, or is this a well-written paper?
- If it is exploited, what does the attacker get that they do not already have from the host they are on?
Nothing there requires a new product. It requires somebody who knows the estate well enough to answer, and time set aside for them to answer it. That is a staffing decision dressed up as a tooling decision, which is why it keeps not getting made.
The cadence is the control, not the sprint
CISA has Medusa affiliates into more than five hundred organisations, and the method is worth sitting with because it is so unglamorous: watch the announcements, then go after whoever has not patched yet. That is not a fast-attacker story. It is a slow-defender story. The organisations that get hit are rarely the ones that patched in nine days instead of three. They are the ones with a class of systems that never gets patched at all, because it belongs to nobody.
There are cases where speed genuinely is the control. The SharePoint pair from July and August, CVE-2026-55040 and CVE-2026-63520, chain an authentication bypass into remote code execution and are being exploited together. A browser flaw like CVE-2026-85046, confirmed exploited, is another. Those deserve the interrupt. The other three hundred and ninety-odd deserve a queue, an owner, and an honest position on what you are choosing not to do.
Two questions I would want answered before the next patch cycle. Which systems in your estate have no owner? And when your team last skipped a month of triage, how would you know?