Microsoft's September 2026 Patch Tuesday addressed 973 distinct security vulnerabilities across Windows and related products, by most counts the largest single release in the company's history. KrebsOnSecurity covered the release as a record-setting event. Two of those vulnerabilities, both Windows elevation-of-privilege flaws, were already being actively exploited before the patches shipped. The raw number matters less than what it demands of every business running Microsoft software, which is to say: nearly every business. If no one on your team is responsible for testing, scheduling, and documenting those fixes, most of them probably are not getting deployed.
That gap is not a minor oversight. Unpatched systems are one of the most consistent entry points in ransomware attacks, and the window between a patch release and active exploitation in the wild has narrowed considerably in recent years. A release of this scale makes that exposure problem much harder to manage without a dedicated process behind it.
Why a Release of This Scale Is Different
Every month, Microsoft releases security fixes on Patch Tuesday. Most months, the list runs into the dozens. A release approaching the thousands is different in kind, not just in degree.
Here is what that volume actually demands:
- Triage. Not every vulnerability carries the same urgency. Some are being actively exploited in the wild right now. Others are theoretical, requiring specific conditions that may not exist in your environment. Triaging which fixes are critical, which can be scheduled, and which may need additional testing before deployment requires both technical skill and access to current threat intelligence.
- Compatibility testing. A patch that breaks a line-of-business application or a specialized piece of software can cause an outage just as costly as an attack. Testing fixes before pushing them broadly is standard practice in a managed environment. It is rarely practiced in a self-managed one.
- Scheduling. Deploying patches mid-day interrupts work. Deploying them with no coordination at all means they either never run or they restart machines at the worst possible moment. Managed patching schedules updates around business operations.
- Documentation. For businesses subject to any compliance requirement, the question is not only whether patches were applied but whether there is a record proving it. A ticketed, auditable patch log is a compliance asset. A mental note that updates "look like they ran" is not.
A release of nearly 1,000 vulnerabilities multiplies the workload across all four of these areas simultaneously. For a business without a dedicated IT team, that workload lands on whoever is closest to the problem, usually an office manager, a bookkeeper, or an owner who already has a full job.
The Exploitation Window Has Shrunk to Days
There was a time when the conventional wisdom was that businesses had weeks to deploy patches before attackers weaponized them. That window has closed significantly. Industry vulnerability-intelligence tracking now puts the median time from disclosure to active exploitation at under five days, down sharply from a matter of weeks just a few years ago. Roughly one in four exploited vulnerabilities in 2026 has shown evidence of exploitation on or before its public disclosure date, meaning there was effectively no patch window at all.
This matters because the traditional self-managed approach, updates applied whenever someone remembers or whenever a machine prompts for a restart, does not operate on a days-long schedule. It operates on a weeks-to-months schedule, if it operates at all.
Unpatched vulnerabilities are consistently identified as a primary initial access vector in ransomware incidents. The math is straightforward: more unpatched systems, more exposure time, more risk. A release of this size, left unmanaged, extends that exposure across a very large number of potential entry points.
The Three Businesses Most at Risk Right Now
Not every business handles this the same way. Three situations create the most concentrated risk:
- Owner-operated businesses with no IT staff. Updates are applied when a prompt becomes impossible to dismiss, or not at all. There is no triage, no testing, no documentation. The owner's attention is the only governor on the process.
- Businesses with a single internal generalist. One person cannot carry a complete patch management process, run the help desk, manage vendors, and support daily operations. Patching gets deprioritized under the pressure of immediate problems, especially when a release of this size arrives and no one has a tested process for handling it.
- Businesses that treat Windows Update as the whole answer. Windows Update handles the operating system. It does not handle third-party applications, many of which contain their own vulnerabilities that require separate patching processes entirely. Browsers, PDF readers, productivity plugins, and industry-specific software all carry exposure that automatic Windows Updates will never touch.
What Managed Patching Actually Does
Endpoint patching is a defined component of Onsite Technical Services' managed IT offering, covered under the Endpoint Patching and Updates layer of the security stack. Here is what that means in operational terms, not as a marketing description but as a description of the work being performed.
- Patches are assessed against current threat intelligence. Actively exploited vulnerabilities are prioritized for faster deployment. Lower-severity fixes follow a tested schedule.
- Compatibility testing happens before broad deployment. Fixes are evaluated against the client's environment before being pushed to every machine, reducing the risk of a patch causing an outage.
- Deployment is scheduled around business hours. Updates run during maintenance windows, not in the middle of client meetings or deadline work.
- Every patch cycle is documented. The ticketing system creates an auditable record of what was deployed, when, and to which systems. That record exists whether or not anyone ever asks to see it.
- Third-party applications are included in scope. Windows is not the only surface that needs patching. A managed program covers the broader application landscape, not just the operating system.
This is work that has to happen regardless of who does it. The question is whether it is being done deliberately, on a schedule, with documentation, or reactively, when something breaks.
What to Check at Your Business Right Now
You do not need a managed IT program to ask these questions today. But the answers will tell you a great deal about your actual exposure.
- Who is responsible for applying security patches to your Windows machines? Is that responsibility written down anywhere?
- When were your systems last patched? Can you prove it?
- Do you know whether your third-party applications, browsers, PDF tools, accounting software, and industry-specific platforms are on a patch schedule separate from Windows Update?
- If a critical vulnerability is disclosed today, what happens at your business in the next 72 hours?
If those questions do not have clear answers, the September 2026 Patch Tuesday release is a useful moment to decide whether the current approach is sufficient for a threat environment where exploitation windows are measured in days, not weeks.
Planning Guidance: What Managed IT Costs for a Small Business
For businesses evaluating whether a managed program makes sense financially, Onsite Technical Services' Standard Managed Services runs in the range of $150 to $200 per user per month, all-in. That range includes managed patching along with security monitoring, endpoint protection, Microsoft 365 administration, and help desk support. It is a planning benchmark, not a quote, because cost varies with user count, security scope, and the complexity of your environment.
An entry-level Essentials program starts at $100 per billable unit per month and covers a defined baseline. The core distinction between tiers is not a product checklist. It is the scope of operational responsibility the provider carries on your behalf, including how much of the patching, monitoring, and documentation workload moves off your plate entirely.
Either way, the question is not whether patching costs money. It is whether the cost of a managed process is proportionate to the cost of a breach that started through an unpatched vulnerability. For most small businesses, that comparison is not close.
