1,413 vulnerabilities in October can make patching feel unmanageable, but Tyler Reguly argues that volume alone is a distraction. With 26 2026 Microsoft CVEs appearing in CISA’s KEV catalog, security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act.
By Tyler Reguly, Associate Director, Security R&D, Fortra
Recently, I’ve argued that numbers are meaningless. This month’s number, 1413, is no different. There are, however, numbers that hold meaning. 26, for example, is how many 2026 Microsoft CVEs have shown up in the CISA KEV. Last year, that number was 30, and the year before was 32. That means less than 1% of vulnerabilities patched by Microsoft this year are known to be exploited. That’s an important number… but 1413 definitely isn’t.
I’ve talked to some people recently who’ve commented on the number of vulnerabilities announced this year, and I’ve spent a lot of time trying to think of how to explain it to them.
In the US, there are around 5000 movies available in the Netflix catalog depending on which source you look at. At any given moment, you care about one or two of those movies – the one you want to watch and, maybe, the one you want to watch next. The rest are just background noise. You prioritize those movies based on what you want to see, which is decided by your preferences. You don’t need to care about every vulnerability, just the one you are going to patch next, which you prioritize based on factors that matter to your organization. The rest of the vulnerabilities… background noise, no different than that random 1970’s creature feature that keeps showing up on your recommendations, even though you’ll never watch it.
“Pop Quiz, Hotshot” has always been one of my favorite quotes and today I’m directing that statement toward all the CISOs out there with teams actively working on Patch Tuesday. I want each of you to ask yourselves these 5 questions, to see if you really understand those teams work and if you are setting them up for success.
- Is your team feeling patch fatigue – how tired/stressed are they?
- Do you and your team truly understand your organization’s prioritization metrics?
- How complete is your organization’s asset inventory?
- Are you adequately resourced in terms of people, hardware, and software?
- What single wish list item do they have that would make their lives easier? Have you ever asked?
The answers to these questions may open your eyes to the needs of your team and help make them a happier, more productive group of individuals.
Related
This entry was posted on October 13, 2026 at 3:48 pm and is filed under Commentary with tags Fortra. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
October Patch Tuesday: The real problem isn’t the number of vulnerabilities
1,413 vulnerabilities in October can make patching feel unmanageable, but Tyler Reguly argues that volume alone is a distraction. With 26 2026 Microsoft CVEs appearing in CISA’s KEV catalog, security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act.
By Tyler Reguly, Associate Director, Security R&D, Fortra
Recently, I’ve argued that numbers are meaningless. This month’s number, 1413, is no different. There are, however, numbers that hold meaning. 26, for example, is how many 2026 Microsoft CVEs have shown up in the CISA KEV. Last year, that number was 30, and the year before was 32. That means less than 1% of vulnerabilities patched by Microsoft this year are known to be exploited. That’s an important number… but 1413 definitely isn’t.
I’ve talked to some people recently who’ve commented on the number of vulnerabilities announced this year, and I’ve spent a lot of time trying to think of how to explain it to them.
In the US, there are around 5000 movies available in the Netflix catalog depending on which source you look at. At any given moment, you care about one or two of those movies – the one you want to watch and, maybe, the one you want to watch next. The rest are just background noise. You prioritize those movies based on what you want to see, which is decided by your preferences. You don’t need to care about every vulnerability, just the one you are going to patch next, which you prioritize based on factors that matter to your organization. The rest of the vulnerabilities… background noise, no different than that random 1970’s creature feature that keeps showing up on your recommendations, even though you’ll never watch it.
“Pop Quiz, Hotshot” has always been one of my favorite quotes and today I’m directing that statement toward all the CISOs out there with teams actively working on Patch Tuesday. I want each of you to ask yourselves these 5 questions, to see if you really understand those teams work and if you are setting them up for success.
The answers to these questions may open your eyes to the needs of your team and help make them a happier, more productive group of individuals.
Share this:
Like this:
Related
This entry was posted on October 13, 2026 at 3:48 pm and is filed under Commentary with tags Fortra. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.