What a patch process for double volume costs
May 27th, 2026 by Jesper Kråkhede
After this month´s AI found vulnerabilities, a business question: what does it cost to run a patch process that can handle twice as many patches?
Let´s look at where the time goes. Testing that a patch doesn´t break critical applications. Scheduling and running maintenance windows. Restarting servers and checking that services come back. Handling the systems that fail. Following up on the machines that were offline. Reporting to management and auditors.
If all of that is manual, doubling the volume doubles the cost, or more likely, doubles the backlog. In most organisations, it will be the backlog.
The alternative is to invest in automation now. Update rings, so patches are tested automatically on a small group first. Automatic deployment with automatic rollback. Hotpatching where available, so fewer restarts are needed. Automated health checks after the restart. Exposure data, so you know which patches matter most.
These investments cost money and time up front. But they scale. Ten more patches a month cost almost nothing when the process is automated.
Then there are the systems that can´t be automated: legacy applications, OT, systems owned by suppliers. They need a plan of their own. Isolation, compensating controls or replacement.
So for management: ask what percentage of your patching is automated today, and what it would cost to raise it. Compare that with the cost of the backlog when the wave hits.
The cheapest patch is the one nobody had to touch.