Security patches need patches now that attackers have AI

Terra Security found that GitHub security fixes requiring a follow-up advisory for a failed patch within 90 days rose to 2.3% in 2026, from about 0.2% annually between 2019 and 2025. Terra also reported that vulnerabilities with bypassed fixes were about four times as likely to appear on CISA’s Known Exploited Vulnerabilities list as other bugs from the same vendors; prototype-pollution and server-side request forgery fixes were disproportionately affected. The findings highlight patch-quality risks for software vendors and defenders, including a cited Windows flaw exploited by Russian government cyberspies before and after Microsoft’s initial fix.»

Analysis

The investable read-through is not that Microsoft’s security franchise is impaired, but that patch quality is becoming a measurable execution risk. For Microsoft, repeated fixes can raise incident-response and engineering costs and—if enterprise admins delay deployment—extend the window in which a disclosed flaw is exploitable. A broader trust or renewal impact is possible, but the article provides no evidence of customer losses or financial materiality.

Second order: patch validation, application security testing, and managed vulnerability-remediation providers could see demand accelerate as customers add staged rollout and regression testing. That benefit is conditional: Terra’s review of published CVEs and GitHub-reviewed advisories is not a complete measure of software-wide failure rates, and higher reported bypasses may partly reflect more AI-enabled discovery and disclosure. The kernel figures also should not be generalized to all Linux deployments.

Near term, patch reversals and new advisories are the catalyst; over 1–3 months, watch Microsoft’s security updates and enterprise guidance for evidence of repeated Windows remediation or customer disruption. Over 6–18 months, a durable shift toward secure-by-design fixes could increase vendor development costs while expanding security-tool budgets. The contrarian point: faster discovery and follow-up fixes may indicate better scrutiny and response, not a worsening net security outcome. A standalone MSFT short is not justified by this evidence.

Key Decisions for Investors

• No immediate directional MSFT trade. Put the Windows patch cycle on alert: reassess if Microsoft issues repeated corrective updates for the same vulnerability class or reports material customer disruption; thesis weakens if fixes remain isolated and deployment proceeds without disruption.
• Track cybersecurity testing and vulnerability-management providers, including CrowdStrike and Palo Alto Networks, as potential demand beneficiaries—not an automatic long. Seek confirmation in bookings, guidance, or customer commentary before positioning.
• Over the next 1–3 months, monitor follow-up advisories, CISA Known Exploited Vulnerabilities additions, and enterprise patch deferrals. Rising incidents paired with delayed remediation would be more negative for software vendors than a higher count of reported bypasses alone.
• Before treating Terra’s 2026 increase as a structural trend, verify the sample size, reporting coverage, and year-to-date comparison period. A change in disclosure or AI-assisted discovery could explain part of the jump; if so, avoid extrapolating it into broad software-sector earnings risk.