The News, Explained

On November 5, Microsoft described how it is expanding the use of AI to find and fix Windows security flaws. A vulnerability is a weakness in software that can be exploited. Microsoft uses AI to look for suspicious code, investigate affected versions and similar flaws, and help prepare tests for other features that a fix might break. Engineers review the findings, decide how to fix them, and remain responsible for the result. Source

A fix can be available for days or weeks before it reaches each PC. In an August 2026 sample of enterprise Windows devices reported by Microsoft, fewer than half had installed the security update two weeks after release. About one in four still had not installed it after four weeks. Those figures describe the enterprise devices Microsoft measured. Source

Monthly Windows security updates are cumulative, so they include previous fixes. Instead of picking patches flaw by flaw, an organization can decide which group of devices should receive the update first, such as systems exposed to the internet. Microsoft’s Security Update Guide helps teams identify which products a vulnerability affects. Source

On some managed PCs, hotpatching applies monthly security fixes without a restart. Microsoft’s guide requires Windows 11 version 24H2 or later, an eligible license, and the latest baseline update. The organization also has to enable hotpatching in its Intune device management policy and meet device settings such as VBS, which uses virtualization to isolate security functions. The periodic cumulative baseline updates form the starting point for later hotpatches and still require a restart. Source Source

OYOPICK’s Take

For IT teams, it is useful to record when they began deploying an update separately from the share of devices that actually applied it. Measuring that share seven and 14 days after release for internet-facing systems and ordinary work PCs separately can expose delays that an overall average hides. Testing critical apps on a small group first, then prioritizing higher-risk devices based on that result, gives teams a way to assess speed alongside business continuity. Source