The Houston Area Patch Index Is Live. You Are Probably Patching in the Wrong Order.

The most common triage rule in small business IT, tested against 38,446 advisories.

Severity tells you what could go wrong. Exploitation tells you what is going wrong. Of the 7,442 advisories published across our tracked vendors in 2026, 4,753 were rated critical or high, and 57 have been confirmed under active attack by CISA.

That is roughly 83 times less work for the fixes carrying real, observed risk. Across the entire dataset going back to 2022, only 1.41% of published advisories have ever been confirmed exploited in the wild.

What most people believe: a CVSS score of 9.8 means drop everything. What the data shows: a 9.8 that nobody has ever weaponized is a maintenance-window item, and a 7.2 sitting in CISA's Known Exploited Vulnerabilities catalog is an emergency.

One caution on the percentage itself. When the index says 65.3% of 2026 advisories are critical or high, that is a share of the advisories carrying a CVSS score at all. Unscored records are excluded from the denominator rather than quietly counted as harmless. That distinction matters when a vendor dashboard shows you a reassuring number built the other way.

Sorting by exploitation is not the same as ignoring severity. A critical-rated flaw in an internet-facing system still deserves a real maintenance window. The point is sequence, not permission to skip. Confirmed exploitation sets what gets done this week; severity sets what gets done this quarter.

• Check the catalog against your inventory weekly. Anything listed that touches your stack jumps the queue regardless of its score.
• Treat severity as the second sort, not the first. It orders the remaining work rather than defining the emergency.
• Record what you skipped and why. A deliberate deferral you can explain is a decision. An undocumented one is a finding in your next insurance questionnaire.

The timing assumption behind quarterly maintenance windows, measured against 353 confirmed cases.

72% of the flaws that get exploited are under confirmed attack within 30 days of the fix shipping, and 95% within a year. We measured the gap between publication date and the date CISA confirmed exploitation across 353 cases in the index.

The years-long exposure stories get written up because they are dramatic. They are also the tail, not the pattern. Flaws first attacked more than three years after their fix account for roughly 1% of confirmed cases in the dataset.

A business patching monthly sits inside that window for most confirmed cases. A business patching quarterly, or whenever someone finds a free evening, sits outside it for the majority. In 30 years doing this, the pattern we see over and over with Houston businesses is not a company that refused to patch. It is a company that patched on a schedule set before the schedule mattered.

Why the index deliberately refuses to rank vendors by advisory volume.

A high advisory count usually reflects more transparency, not worse security. A vendor publishing hundreds of fixes is telling you what it found. A vendor publishing none may simply have no public disclosure program.

This is why the Houston Area Patch Index measures workload landing on your IT team rather than grading vendor engineering. Six vendors were excluded from the charts entirely for insufficient signal, and that exclusion is a data-quality decision, not a verdict on their products.

What most people believe: pick the vendor with fewer CVEs. What the data shows: silence is not safety. You cannot patch what a vendor never tells you about, and buying on advisory count rewards the companies that disclose least.

• Microsoft leads confirmed exploitation with 134 advisories in CISA's catalog across the window, ahead of Apple at 35 and Cisco at 32.
• Volume and risk are different measurements. Oracle published 1,552 advisories in 2026 and carries 12 confirmed exploited across the whole dataset.
• Small vendors are not low risk. Ivanti published 26 advisories in 2026 and carries 22 confirmed exploited since 2022, nearly one confirmed attack for every advisory it shipped this year.

There is a real question buried under the bad one. Instead of asking which vendor publishes fewer flaws, ask which vendors in your stack show up repeatedly in the exploited catalog, because that is where an attacker has already done the engineering work. In the index that list is short and stable: edge devices, browsers, and remote-access tooling.

What the index shows once you look past Patch Tuesday.

Advisory volume in 2026 is running about 2.6 times the 2025 pace across every tracked vendor, not just Microsoft. Severity climbed with it: the critical-plus-high share of scored advisories sat between 53% and 57% for four straight years, then reached 65.3% in 2026.

Microsoft published 644 advisories in July 2026, the largest single month in the dataset, against a range of 38 to 181 for the previous 53 months. That number earned the headlines. The rest of the field moved just as sharply.

The driver is AI-assisted vulnerability discovery reaching production. Microsoft credits its own in-house scanner, MDASH, announced in May 2026, and Windows chief Pavan Davuluri wrote on July 9, 2026 that update volumes will keep trending larger. Separately, Anthropic's Project Glasswing launched April 7, 2026, putting security-focused AI in the hands of member organizations. These are competing systems, not one program, and Microsoft has credited MDASH rather than its Glasswing access for its own volume.

For a Houston business the mechanism matters less than the arithmetic. If patching took your IT team one working day a month in 2025, the same coverage now needs roughly two and a half. Nobody we know budgeted for that in their 2026 plan, and the vendors are not slowing down.

Two of those growth numbers deserve a caveat before anyone quotes them. Oracle ships most of its advisories in quarterly Critical Patch Updates, so its year-over-year figure is lumpy by design rather than a sudden collapse in code quality. Chrome's jump reflects both real discovery volume and a change in how thoroughly its records are scored. The industry-wide 2.6 times pace holds with or without either one.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees.

We handle patching on a flat monthly rate per endpoint, with no contracts, no hidden fees, and no cancellation penalties. Endpoints track headcount, so the number you pay for is the number you actually run. Patch verification is the part most providers skip: deploying a fix and confirming it applied are two different jobs, and only one of them shows up in a breach report.

• Managed IT support covering inventory, testing, deployment, and verification.
• Cybersecurity services that rank fixes by confirmed exploitation first.
• Business continuity and disaster recovery with geo-redundant backups outside the Gulf Coast flood zone, so a bad patch is a restore rather than a rebuild.
• IT support in Houston and Katy, with help desk response under 15 minutes.
• Industry work across construction, CPA firms, law firms, and oil and gas.

The index is free and we are not gating it. Use it to see what your own stack generates, then ask whoever handles your patching one question: what is our average number of days between a fix being published and being installed? If nobody can answer, that is the number to fix first. Happy to walk through yours, talk to CinchOps.