The vulnerability surge and why every business needs to keep up

Much of that growth can be seen in the software nearly every business runs. In an analysis published in October, IBM X-Force found that vulnerability disclosures for Microsoft, Oracle, Google Chrome and Apache rose from about 1,493 in the first nine months of 2025 to more than 10,124 over the same period this year, an increase of roughly 578%. Chrome disclosures alone were up about 2,456%.

Attackers are moving faster, too. Rapid7's 2026 Global Threat Landscape Report found that the median time between a vulnerability's publication and its addition to CISA's Known Exploited Vulnerabilities (KEV) catalog fell from 8.5 days to 5. For the first time in the 19-year history of Verizon's Data Breach Investigations Report (DBIR), exploiting a vulnerability was the most common way attackers got in, accounting for 31% of breaches. In the same report, only 26% of known exploited vulnerabilities were fully remediated, and the median time to patch grew from 32 days to 43.

Now, put those last two findings side by side and you get a very dire pattern: Confirmed exploitation typically shows up within about five days of a vulnerability going public, while the typical organization takes about six weeks to patch it. So while the rate of vulnerability discovery and disclosure is accelerating, the patch rate for organizations isn't keeping up.

Keep core systems updated

Patching is still the most effective defense a business has, and it reaches well beyond the operating system . Mail servers, help desk and CRM platforms, VPN appliances, firewalls, routers and their firmware, hypervisors, browsers, plugins and the open-source libraries buried inside commercial products all carry vulnerabilities, and attackers are scanning for all of them.

Then there's the forgotten machine. Our own network breach in January started with a single VM an employee had set up that wasn't being updated. It was one of roughly 30 servers and VMs running SmarterMail on our network, and it was the one that was compromised. We wrote about it openly at the time, and the lesson has stayed with us: the system nobody knows about is the system nobody patches. A good patch program starts with an accurate inventory and then works through a few habits:

• Know everything you run, including test, staging and "temporary" systems.
• Subscribe to security notices from every vendor whose software you depend on.
• Patch internet-facing systems and anything on CISA's Known Exploited Vulnerabilities catalog first.
• Stay on supported versions. End-of-life software doesn't get fixes, no matter how serious the flaw or how big the vendor.

User training is key

The Binance theft started on an engineer's laptop, and that's a typical scenario. The 2026 DBIR found that the human element was involved in 62% of breaches. AI helps attackers here as well: phishing messages no longer give themselves away with clumsy grammar, and a convincing fake request from a vendor or executive takes seconds to write.

Regular, practical training makes a measurable difference. Employees should know how to recognize phishing and pretexting, verify unusual requests for credentials or payments through a second channel, and report something suspicious quickly without worrying about blame. Pair that with multi-factor authentication and least-privilege access, so that a single compromised account or laptop can only reach what that person truly needs. If you host email or other services for customers, their users are part of your attack surface, too, and the same guidance is worth passing along.

Work with responsive vendors

Your security also depends on the companies whose software you run. In the 2026 DBIR, breaches involving a third party rose to 48%, up from 30% the year before. When you evaluate a vendor, or re-evaluate one you already use, a few questions are worth asking:

• How quickly do you release fixes for critical vulnerabilities?
• How will you notify me, and what will that notice tell me?
• Can I reach a person who can help when something goes wrong?
• How long do you support a version once a newer one is released?

A vendor that answers those well turns a newly disclosed vulnerability into a short, manageable task. One that doesn't can leave you exposed for weeks.

How we handle things at SmarterTools

Even though our incident rate is substantially below the industry average, and well below the growth in CVEs overall, we face the same underlying threats as everyone else. The AI tools finding flaws in other products are being pointed at ours, too. Here's how we respond when an issue comes up.

We fix it fast. When a vulnerability is reported or discovered, it moves to the front of our development queue, and we release a fix within days of the issue being identified.

We plan our notifications carefully. Every security notice we publish is written to give administrators enough information to understand how serious an issue is and how urgently they need to update, without publishing the kind of technical detail that would help an attacker exploit servers that haven't been patched yet.

Our support team is easy to reach. If you can't update right away, or you aren't sure whether you're affected, our team can help you assess your exposure, apply mitigations and get onto the fixed build. When it helps, we write step-by-step guides so administrators can work through the process on their own schedule.

We are becoming increasingly proactive. We have increased our own use of AI, from the development process through quality control. Our developers spend hours reviewing and re-reviewing their code to find and fix weak points. AI is more than the future; it’s the present, and we are taking full advantage of it to help us prevent mistakes that can lead to exploitable weaknesses in all of our products.

That's also why we put so much weight on Software Maintenance and Support. It keeps you on current builds, security fixes included, as soon as we release them, and it keeps our support team on your side when you need it. Of all the systems a business depends on, its communications platforms, like its email server and help desk, are some of the last ones that should fall behind.