Microsoft Urges Faster Patching as AI Speeds Attack Code
Microsoft says fewer than half of enterprise Windows devices were patched within two weeks, per August 2026 telemetry.
Microsoft said on November 8, 2026, in a post on its official blog, that enterprises need to shorten the time between the release of a security update and its installation, arguing that AI has accelerated the development of attack code that exploits vulnerabilities.
The company pointed to its own telemetry as evidence that patching is moving too slowly. In August 2026, according to Microsoft's data, fewer than half of surveyed enterprise Windows devices had installed security updates within two weeks of release, and about one in four had still not installed them after four weeks.
Microsoft said it uses a code scanner called MDASH, which runs multiple AI models and specialized agents, to find and validate potential vulnerabilities. The tool also assists during remediation by identifying the affected Windows versions and locating similar flaws in related code, while engineers remain responsible for final review and decisions.
On the deployment side, Windows 11 includes Windows Autopatch for managing staged rollouts, and eligible devices can use hotpatching to apply monthly security updates without restarting.
Microsoft said reducing the gap between update release and deployment should be treated as a security priority.
Quick answers
What did Microsoft say about AI and security updates?
Microsoft said on November 8, 2026, that AI has accelerated the development of attack code exploiting vulnerabilities, and that enterprises should speed up applying security updates.
How many enterprise devices install Windows updates on time?
Per Microsoft's August 2026 telemetry, fewer than half of surveyed enterprise Windows devices had installed updates within two weeks of release, and about one in four still had not after four weeks.
What is MDASH?
MDASH is a Microsoft code scanner that uses multiple AI models and specialized agents to find and validate potential vulnerabilities; engineers make the final review and decisions.