When "Critical" Stops Meaning Anything: Rethinking How You Prioritize Patches
Monthly patch volumes keep climbing and severity scores can't keep up. Here's a risk-based framework for vulnerability triage that regulated industries can actually sustain.
Every organization running Windows, Office, or SharePoint has a version of the same monthly ritual: a wave of vendor advisories lands, a spreadsheet fills up with CVE numbers, and someone on the IT team has to decide what gets patched this week versus what can wait. For years, the shortcut was simple — patch anything labeled "Critical" first, work down from there, and hope the queue empties before the next release.
That shortcut is breaking down, and it isn't a one-month problem.
Microsoft's July 2026 Patch Tuesday closed out with over 600 CVEs in a single release — more than triple the volume from just one month earlier, and the largest release the company has shipped to date. Two of the flaws were already being used in active attacks before the patch existed. Neither one carried a headline-grabbing severity score. Both were mid-tier privilege escalation bugs in identity and collaboration infrastructure — the kind of thing a severity-only triage process would have queued behind a dozen "more critical" issues.
That gap between what's labeled dangerous and what's actually being exploited is the real story, and it shows up every month, not just this one.
Why the volume keeps climbing
Vendors are increasingly using AI-assisted tools to hunt for vulnerabilities in their own code before attackers find them first — and it's working. Microsoft has said openly that it expects larger, more frequent security releases as this kind of automated discovery scales up. That's a good thing for the industry in the long run. In the short run, it means the monthly patch list isn't going back to the size it used to be.
The catch is that the same automation cuts both ways. Once a patch ships, attackers can compare the new code against the old release, isolate exactly what changed, and build a working exploit in a fraction of the time it used to take. The old assumption — that a business has a week or two of breathing room before a patch needs to be tested and deployed — no longer holds in every case.
Higher volume, faster exploit development, and a shrinking response window is not a one-time spike. It's the new baseline for vulnerability management.
The problem with sorting by severity alone
CVSS scores were designed to describe how bad a vulnerability could theoretically be — not how likely it is to be used against your organization this month. When a single release contains hundreds of CVEs and a large share of them carry High or Critical ratings, "Critical" stops functioning as a filter. It becomes a label attached to most of the list.
Meanwhile, the vulnerabilities most likely to hurt you are often the ones already in an attacker's toolkit, regardless of their score. A privilege escalation bug in an identity system, or an authentication bypass in a document platform, can be more dangerous in practice than a higher-scored bug that requires conditions an attacker rarely has access to.
Severity still matters. It just can't be the only input.
A risk-based framework that holds up month over month
Instead of triaging by score alone, a sustainable patch prioritization process weighs three additional signals:
- Is it being actively exploited? Vendor-confirmed exploitation and third-party tracking — like CISA's Known Exploited Vulnerabilities catalog — should outrank a raw CVSS number every time. A vendor's own "exploited in the wild" flag is often available before an entry ever reaches a public catalog, so waiting for the catalog listing to act is waiting too long.
- What does it touch? A flaw in the system that issues authentication tokens or governs document access carries more downstream risk than its score alone suggests, because compromising it doesn't just open one door — it can unlock trust across an entire environment.
- What's the realistic exploitability? Tools like EPSS estimate the probability a vulnerability will be exploited in the near term based on real-world attack data, giving a more current picture than a static severity rating that was assigned once and rarely revisited.
Layering these signals on top of CVSS turns a monthly scramble into a repeatable process — one that holds up whether a given month brings 50 patches or 600.
Why this matters more in regulated environments
For organizations in healthcare, financial services, and manufacturing, patch prioritization isn't just an operational question — it's a documentation requirement. Frameworks like NIST CSF, the HIPAA Security Rule, PCI DSS 4.0.1, and FFIEC guidance all expect a demonstrable, risk-based approach to vulnerability management, not a best-effort scramble every second Tuesday. When an auditor or a cyber-insurance underwriter asks how patches get prioritized, "we patch the ones marked Critical" is no longer a sufficient answer on its own.
A documented process — one that references active exploitation status, asset criticality, and exploitability data alongside vendor severity ratings — holds up to that scrutiny in a way that ad hoc triage never will.
Where continuous monitoring fits in
Risk-based triage only works if someone is watching for the signals that make it possible: exploitation activity, changes in exposure, and drift between what's supposed to be patched and what actually is. That's a harder problem for internal teams to keep pace with as monthly volumes grow, which is why more organizations are pairing their patch cycle with continuous vulnerability monitoring and expert-validated review, rather than relying on a point-in-time scan a few times a year.
This is the gap InfoSight's Purple Team SOCaaS and network health monitoring services are built to close — combining AI-accelerated detection with human analysts who validate what's actually exploitable in your environment, so your team isn't guessing which of this month's hundreds of CVEs deserves the next 48 hours.
Not sure whether your current patch management process would hold up under a compliance review — or an actual attack?
Talk to InfoSight's security team about a vulnerability management assessment tailored to your industry.
Stay ahead of evolving threats with expert insights
Subscribe to our newsletter to keep you updated on the latest cybersecurity insights & resources.
One follow-up from a security expert—no spam, ever.