Patch Tuesdays aren’t for everyone: 20% of cyber pros take time off to avoid them
CISOs either call in sick or deliberately book holiday time off.
By Cybernews
Follow us
- 22% of surveyed cybersecurity leaders said they avoided Patch Tuesday by calling in sick or booking leave.
- Leaders report strain: 41% worked overtime, 37% worked late, and 29% felt significant anxiety.
- Microsoft patched 966 vulnerabilities in September, including 105 critical flaws, adding pressure on security teams.
- AI helps vendors find more flaws, but 40% say it also automates routine security work.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
One in five cybersecurity professionals despise Patch Tuesdays so much that they avoid them by calling in sick or booking time off in advance.
Patch Tuesday can be one of the most demanding days of the month for cyber pros. It’s stressful because on this particular day, Microsoft and other tech companies release cumulative security updates and bug fixes.
Even if the existence of a designated day to update the software helps the defenders with a predictable schedule, the workload increases dramatically.
Quite unsurprisingly, results of a new survey from Socura, a British cybersecurity firm, show that a significant chunk of cybersecurity leaders have either called in sick or deliberately booked holiday time off to avoid Patch Tuesday.
While 41% said they’ve worked overtime to manage the patching cycle, and another 37% claimed they’ve worked late to deploy patches, a notable 22% said they’ve tried to swerve the stressful day altogether.
Socura calls the finding “striking” because they didn’t survey junior members of security teams: the poll participants included senior leaders such as Chief Security Officers, Chief Information Security Officers, and Heads of IT Security.
They all are, or should be, directly responsible for their organization’s security and patching cycle.
Socura concludes it’s just a little too much for the cyber pros. The number of patches is indeed growing.
Has your password leaked?
In September, Microsoft alone addressed as many as 966 vulnerabilities, including 105 rated “critical.” For some defenders, that means working overtime or through the night.
Over a quarter (29%) of respondents said they feel “significant anxiety” the night before Patch Tuesday. The same share admitted they become more irritable with colleagues or family during that week.
Patch Tuesday is also stressful because of what can be riding on the decisions made that day. Cyber pros know vulnerabilities need to be dealt with, but they also feel their organizations aren’t giving them enough support and resources, Socura explains.
You expect your accountant to be available for your tax return deadline, and your lawyer for your court date,said Andrew Kays, Socura CEO.
“It speaks volumes about the unhealthy levels of stress and burnout in our industry that cybersecurity leaders would deliberately avoid the office during their most consequential day of work,” Kays added.
Moreover, AI-powered vulnerability research helps vendors discover software flaws in ever-greater volumes.
The good news for defenders is that AI can also help. Forty percent of survey respondents told Socura that AI automates mundane work and frees up teams to focus on more strategic tasks.
