Patching
Getting ready for the patch wave
The NCSC wants security updates deployed faster, more often and through suppliers too. Start with whatever faces the internet.
Last reviewed against NCSC, SecurityWeek and The Register. Sources
The idea
What the wave is
A blog dated 1 May 2026 by the NCSC's chief technology officer asked organisations of all sizes to expect a surge of patches clearing out long-standing technical debt [3]. Coverage of the annual review adds that AI-assisted discovery may lengthen the queue of updates, though not every flaw it finds can be exploited [7].
In practice the issue is volume. A process built for a few urgent patches a month has to cope with many more.
-
1
Find externally exposed systems and shrink that list, beginning with perimeter technology. -
2
When everything cannot be updated, treat the external attack surface first and critical security systems next. -
3
Replace or bring back into support any end-of-life system, above all exposed ones. -
4
Raise the speed and frequency of updates, supply chain included. -
5
Enable hot patching and automatic updates where offered, embedded devices too.
Easy to miss
Process matters as much as tools
Speed comes from decisions taken beforehand. The NCSC says processes and risk appetite should allow frequent, large-scale updating, and suggests ranking work with a risk-based method such as SSVC [3]. Settle in advance who can authorise an emergency change and what level of outage is tolerable.
When a critical flaw is under active exploitation, particularly on an internet-facing system, the NCSC says to accelerate further [3].
Exceptions
Where update by default does not fit
Safety-critical systems and operational technology may need different treatment, the agency accepts [3]. Schedule those updates deliberately and add compensating controls while they wait.
Check this first
Can you name every internet-facing system, its owner and its current patch status? If not, build that list before choosing any tool.
Next
Related pages
Systems that no longer get updates are covered in legacy and unsupported systems, and the wider order of work is on the preparation page.
Keep reading
Read next
Legacy systems
End-of-life and underfunded technology is the weakness the NCSC says AI will expose. How to find it, rank it and plan its replacement.
Read the guide
Access routes
The NCSC's incident data shows four initial access routes behind 88% of incidents at large organisations. What each is and how to reduce it.
Read the guide
Staff AI use
The NCSC's review warns that unapproved AI services can leak company data. How to set rules for staff without blocking useful tools.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC points operators of essential services to the Cyber Assessment Framework. CyPro can assess how well your organisation meets it and set out the resilience work that matters most.