Patching
Preparing for the AI patch wave
The NCSC urges organisations to be able to deploy fixes quickly, frequently and across suppliers. Patch what is exposed first.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
The idea
Why a wave
AI can help find software flaws faster, which could produce a growing workload of security updates [7]. The NCSC's technical lead published advice on 1 May 2026 urging organisations to prepare for a "patch wave" [4]. Not every flaw an AI finds will be exploitable, but delay gives attackers openings [7].
-
1
Shrink the external attack surface first, starting with perimeter technology and then cloud and on-premises systems. -
2
If you cannot update everything, patch external systems first, then critical security systems. -
3
Replace or re-support end-of-life technology, especially anything exposed externally. -
4
Patch faster, more often and at scale, including across your supply chain. -
5
Turn on automatic updates where possible, including for embedded devices.
Cards
Supporting measures
Beyond the first five steps the NCSC adds several measures.
Update by default
Apply updates as soon as possible, ideally automatically. Exceptions may apply to safety-critical systems and operational technology [4].
Rank by risk
Where automation is not available, make sure processes and risk appetite allow frequent updates, and consider the SSVC framework to rank them [4].
Act fast on exploited flaws
Critical flaws under active exploitation, especially on internet-facing systems, need urgent action [4].
Root causes
Longer term
The NCSC also looks beyond patching. Software producers should consider memory-safety and containment technologies, while consumers and operators should implement Cyber Essentials or, for essential services, the Cyber Assessment Framework [4]. Larger organisations should seek assurance from their commercial and open source suppliers [4].
Read next
Related
If you cannot patch something, the answer in the NCSC's advice is usually to replace it or remove its exposure, see end-of-life systems. For the full sequence, see what to do.
Keep reading
Read next
Annual review
What the NCSC Annual Review 2026 reports: 80 nationally significant incidents, 337 needing NCSC support, 1,831 reports and how to read them.
Read the guide
Four routes
Public-facing apps, phishing, valid accounts and external remote services: the four routes behind 88% of incidents at large organisations.
Read the guide
Shadow AI
Unapproved AI services can expose company data, and agentic AI adds access risk. What the NCSC says organisations should do about both.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.