The patch curve, part two
Jun 24th, 2026 by Jesper Kråkhede
In April I predicted a wave of patches over the next two to three years, followed by a lower level than before. Since then, the volume has kept rising, and the AI scanning I wrote about this month is moving into the development pipeline. So let me draw the curve more precisely.
Phase one is the backlog. AI scanning is pointed at existing code, in operating systems, applications and libraries. Years of hidden bugs surface. Patch volumes go up sharply. That is where we are now.
Phase two is the peak. The backlog of the most widely used code is worked through, but at the same time, more vendors start using the same techniques. Smaller vendors and open source projects follow, and their backlogs arrive too. I expect the peak somewhere in the next two years.
Phase three is the new normal. Code is scanned automatically before release, and most bugs are caught there. The volume of patches falls to a lower level than before AI, because fewer bugs survive to production.
There are risks to this picture. Not every vendor will invest in scanning, and their products will keep producing patches. AI written code may introduce new kinds of bugs. And the attackers have the same tools.
For management, the message is this. Plan your patching capacity for the peak, not for today. Choose suppliers who scan their code before release, and ask them about it in procurement. And expect the regulators to ask you the same question about the software you build.
The curve goes up before it goes down. Budget for the climb.