Volume roughly doubled and severity climbed in the same year, which is the unusual part.

Advisory volume in 2026 is running about 2.6 times the 2025 pace on an annualized basis, and it is not one vendor having a bad year. The rise shows up across every tracked vendor group.

• More work, arriving faster. 7,442 advisories were published in the first seven months of 2026 alone, against 38,446 across the full period since January 2022.
• And a higher share of it urgent. Critical plus high reached 65.3% of scored advisories, up from 54.9% the year before, after four years of holding roughly flat.
• Concentrated growth at the top. Google Chrome advisories rose 773% between 2025 and 2026, Oracle 394%, Broadcom and VMware 156%.
• The timing lines up with AI-assisted discovery. Two vulnerability-finding programs went public weeks apart in spring 2026: Project Glasswing on 7 April, an Anthropic-led industry program, and Microsoft's in-house MDASH scanner in May.

On that last point the index is deliberately careful, and so is this post. Microsoft has publicly credited MDASH, its own tool, for its record patch volume - Windows chief Pavan Davuluri said so in July. Nobody has demonstrated that either program caused the industry-wide surge. The index marks when they arrived because the surge and their arrival coincide, and stops there. Correlation is worth showing. Causation would need evidence nobody has published.

Severity tells you what could go wrong. Exploitation tells you what is going wrong.

Patching by severity means chasing 4,753 fixes this year. Patching by confirmed exploitation means starting with 57. That is roughly 83 times less work for the fixes that carry real, observed risk.

Widen the lens and the ratio gets starker. Across the entire dataset, back to January 2022, only 1.41% of published advisories have ever been confirmed exploited in the wild. Ninety-eight and a half percent of the patching work a vendor generates is precautionary. That does not make it worthless, but it does mean that a queue sorted by severity puts nearly five thousand items a year in front of a team that can realistically act on a fraction of them.

Not years. For most exploited flaws, under a month.

Across 353 confirmed cases in the index, 72% of exploited flaws were under confirmed attack within 30 days of the fix becoming available, and 95% within a year.

It also reframes what "behind on patching" means. Being three months behind on the 7,385 advisories nobody is exploiting costs you very little. Being three weeks behind on one that is on the CISA list can cost you the business. Those two states look identical on a compliance checklist and are nothing alike in practice.

The volume leaders and the exploitation leaders are not the same list.

Microsoft accounts for 134 confirmed exploited flaws in the index, ahead of Apple at 35, Cisco at 32, Google Chrome at 30, Ivanti at 22 and Fortinet at 19.

Some of that is simply footprint. Microsoft is in nearly every business stack, so attackers get the widest return from a Microsoft flaw. But the ranking is worth holding next to the growth ranking, because they disagree. Chrome advisory volume grew 773% year over year while contributing 30 confirmed exploited flaws. Ivanti and Fortinet publish far less and land 22 and 19. Edge security appliances are small in volume and heavy in exploitation, which is exactly the profile you would expect for a device that sits on the public internet holding the keys to the internal network.

The finding most likely to be misread is the quiet one. Some vendors in the index publish no advisories at all, and that reads like a clean bill of health. It is almost always the opposite: no public disclosure programme rather than no flaws. You cannot patch what a vendor never tells you about, and a vendor that never tells you anything is a risk you are carrying without a number attached to it.

Four moves, and one reason this lands harder on the Gulf Coast than elsewhere.

The exploitation-first queue matters most where patch windows are hardest to get, which describes a large share of the Houston industrial base.

A downtown professional services firm can reboot workstations on a Tuesday evening. A plant, a terminal or a midstream operator cannot. Production schedules, safety interlocks and vendor-certified configurations mean the maintenance window is scarce and negotiated weeks ahead. When you only get a handful of windows a year, deciding what goes into them is the whole game - and a queue sorted by severity will fill that window with precautionary fixes while a confirmed-exploited flaw waits for the next one. For oil and gas and manufacturing operators especially, ranking by exploitation is not a refinement. It is the only version of the job that fits in the time available.

• Shrink the window, not the workload. The goal is not patching everything faster. It is getting the exploited minority applied within days, and letting everything else follow a normal maintenance rhythm.
• Rank by exploitation, then severity. Anything on the CISA Known Exploited Vulnerabilities catalog that touches your stack jumps the queue regardless of its score, because it is being used right now.
• Know what you run before the alert lands. You cannot prioritize what you have not inventoried. When a flaw hits the exploited list, "do we run that?" has to be answerable in minutes.
• Measure the delay, not the effort. The metric that predicts a breach is the average number of days between a fix being published and installed. If nobody tracks that number, nobody is managing the risk.

That last one is where most small businesses come unstuck. Patching gets reported as activity - updates applied, machines touched, tickets closed - when the only figure that correlates with getting breached is elapsed time on the fixes that matter. In 30 years of doing this, the businesses that got hurt were rarely the ones with no patching process. They were the ones whose process had no clock on it.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

• Through managed IT support, patch inventory, testing, deployment and verification run on a schedule at a flat monthly rate per endpoint, with no contracts, hidden fees or cancellation penalties.
• Through managed cybersecurity, fixes are ranked against the CISA exploited-vulnerabilities catalog so the flaws attackers are using jump the queue instead of waiting their turn.
• Through business continuity and disaster recovery, backups stay geo-redundant outside the Gulf Coast flood zone, so a bad patch or a bad storm is a restore rather than a rebuild.
• For oil and gas and manufacturing clients, IT and OT networks are segmented so a device that cannot be patched on your schedule is not sitting on the same network as the office.
• Across Houston, Katy, Sugar Land and Cypress, help desk response runs under 15 minutes and every engagement carries a 30-day satisfaction guarantee.

The Houston Area Patch Index exists because "are we patched?" is an unanswerable question and "are we patched on the things being exploited?" is not. The first one has 7,442 parts this year and no honest yes. The second has 57 and a straight answer. If you want to know which of those 57 touch what you actually run, talk to CinchOps.