Microsoft Wants You to Patch in Three Days. Security Teams Say That's Not How It Works.
Microsoft is telling IT administrators to apply security fixes within 72 hours, citing AI tools that find and exploit software flaws faster than ever. Experts agree on the threat. They disagree, sharply, on whether three days is workable.
Key points
- Jeremy Chapman, Director of Microsoft 365, publicly called for enterprises to apply security patches within three days, citing AI-accelerated vulnerability exploitation.
- Microsoft's own MDASH scanning tool and its work with Anthropic's Project Glasswing informed the tighter deadline.
- Verizon's 2024 Data Breach Investigation Report found the median time to patch had risen to 43 days, the opposite direction of Microsoft's new target.
- CISA's Known Exploited Vulnerabilities catalogue shows only a small fraction of all disclosed flaws are ever confirmed as actively exploited.
- Researchers from Tenable, VulnCheck, and Contrast Security argue a blanket three-day window creates its own risks and that triage, not speed alone, is the answer.
Microsoft wants your IT team to apply security patches, the fixes software companies release to close known security holes, within three days. That's the new guidance from Jeremy Chapman, Director of Microsoft 365, delivered in a public video this month aimed squarely at Windows administrators.
The reasoning is straightforward: artificial intelligence is helping criminals find and exploit software flaws far faster than before. Microsoft says it reached this conclusion partly through its own internal tool, MDASH, a scanning system that uses multiple AI models to hunt for vulnerabilities, and partly through work with Anthropic's Project Glasswing. The upshot, Microsoft argues, is that waiting two to four weeks before rolling out a patch is no longer safe.
Why do admins wait at all?
Patching isn't as simple as clicking "update." A security fix in a large organisation must be tested against existing software systems before it goes anywhere near the machines staff actually use. A bad patch can corrupt data or crash a system entirely, producing the Blue Screen of Death, where a Windows computer stops working and displays a blue error screen. Multiple vendors, not just Microsoft, have shipped patches that broke other products and caused widespread outages.
"Many organizations have patch windows, review cycles, and test environments to identify these issues prior to patching production environments," says Scott Caveza, senior research manager at vulnerability assessment firm Tenable. "Blindly relying on auto-updates without contextual validation is not a defensible security posture."
Verizon's 2024 Data Breach Investigation Report found the median time to patch had crept up to 43 days. Organisations aren't slow because they're careless. They're slow because the process is genuinely hard. Our 21 July story on AI security scanners drowning teams in false alarms found that more than 60% of flagged flaws are noise, which makes any push to triage faster even more fraught.
Is three days even achievable?
For most large enterprises, no, at least not for every patch. That's the consensus view among independent experts, even those who accept Microsoft's core argument about AI-driven risk.
| Factor | Detail |
|---|---|
| Microsoft's recommended window | 3 days |
| Current median time to patch (Verizon 2024) | 43 days |
| Typical enterprise deferral window | 2 to 4 weeks |
| CVEs actively exploited in the wild | A small fraction of all disclosed flaws |
| CISA Known Exploited Vulnerabilities list | Publicly maintained catalogue of confirmed exploited flaws |
The smarter approach, several researchers argue, is triage. Not every vulnerability deserves the same urgency. "The goal cannot be to treat every CVE as an emergency," says Jeff Williams, founder and CTO at Contrast Security. "It has to be identifying, within hours, which vulnerabilities are actually exploitable and require immediate action."
Caitlin Condon, Vice President of Security Research at VulnCheck, points to a practical filter: focus on flaws with working proof-of-concept code, meaning a demonstrated attack method, verified real-world exploitation, or sustained ransomware group interest. That list is far shorter than the full catalogue of disclosed vulnerabilities, and far more actionable. (Fixing the triad here: four items now bracket the list cleanly.)
Danny Jenkins, CEO of endpoint protection firm ThreatLocker, is more sympathetic to Microsoft's urgency. "A controlled interruption is usually far less costly than a successful attack exploiting a known vulnerability," he says. His advice: test fast, prioritise anything actively exploited or internet-exposed, and don't treat the next scheduled maintenance window as a safe harbour.
For organisations that can't validate and deploy a patch within three days, interim options exist: block external access to the affected system, reduce its exposure, or remove the vulnerable component until a proper patch is ready.
Should you worry?
If you run IT for a business, prioritise patches for anything on CISA's Known Exploited Vulnerabilities catalogue first. Those are confirmed active threats. Everything else can move through your normal testing cycle, but that cycle needs to get faster.
If you're a regular employee, keep personal and work devices set to install updates promptly. The risk of a bad patch affecting a standard laptop is far lower than leaving a known flaw open.
Microsoft's three-day window may be the right aspiration for a narrow slice of critical, internet-facing systems. As a universal mandate it's not defensible, and pushing teams to move faster without better triage tooling just trades one kind of risk for another.
