The patch wave is coming
Apr 29th, 2026 by Jesper Kråkhede
Here is a prediction I have been thinking about for a while. Because AI is now used to find vulnerabilities at scale, we will see a wave of patches over the next two to three years. Then the volume will come down again, to a lower level than before.
Why up first? Because there is a huge backlog of old bugs in existing code. Code written over decades, reviewed by humans who couldn´t possibly see everything. When AI scanning is pointed at that code, it finds what was always there. Every one of those findings becomes a patch.
Why down later? Because the same scanning will be built into development. Code will be scanned automatically before it is released, and many bugs will never reach production. Once the backlog is cleared and new code is scanned at the source, fewer patches will be needed.
For management, the important part is the wave. For two or three years, your IT department will have to install more patches than ever. If your patch process is built for the old volume, it won´t cope.
So prepare now. Make sure patching is automated wherever possible. Make sure there are enough maintenance windows and that they are actually used. Make sure your critical systems can be patched quickly, or replaced. And budget for it. More patches means more testing, more restarts and more work for a while.
There is a compliance angle too. Many regulations require timely patching. When the volume doubles, ‘timely’ gets harder to prove.
The wave will pass. Make sure you are still afloat when it does.