It has long been standard advice to keep systems and software up to date with patches as one of the standard infosec “bromides”. In my mind, in today’s world, this is a necessary but not sufficient bit of advice. In a world where vulnerabilities were discovered slowly, and some large subset of them were publicly known and vendors/software maintainers were quick to put out patches, that the advice to patch could conceivably close a lot of the holes. But there have been cracks in that model for a long time. The holy grail of the red teamer has, for decades, been the possession (or, better, discovery) of an “zero-day” and development of an exploit. But the rate of discovery has been increasing for decades. The keepers of the catalog of things that need to be patched, CVEs, have been behind the curve. Governments, “security” companies, hackers have long been stockpiling “goodies” that they never submit to the “ethical disclosure” pipeline, and even when they do, things are often not patched until something blows up. On top of that, a former co-worker who is a PhD statistician framed the whole vulnerability question in her native terms: known vulnerabilities are just a small sample from a much larger population. We can use it to infer, for instance, that there are more total bugs in Firefox than Edge based on what’s known, but we cannot infer that a completely patched system is a secure system. Given the advent of AI, the rate of discovery (by those who responsibly disclose and those who don’t) has been put on steroids. The old bromide that drove “Patch Tuesday” is just that, a bromide. Necessary, but in no way sufficient. It may give IT departments and CISOs something to point at. It will not guarantee secure systems.

What replaces over-reliance the old “patch and you’re good” canard? More old standbys. Assume compromise, reduce blast radius, segment, log, implement least privilege, and treat patching as one of several window-shrinking activities rather than the security activity.

There was an old TV commercial that encouraged patients to “Ask your doctor if the purple pill is right for you”, in this case you might want to feed your personal security situation (devices you use, important accounts you want to protect) to “the AIs” and see what they have to say. The answers might be things like managers, backups, network segmentation (guest networks), running browsers in isolation (flatpack). I’ve recently made more peace with incremental security improvements being “better”, even though I know of an infinite list of security things I “should” do. And I just updated my system and packages.