Critical OS patching across PCs running Windows 10 and 11 is behind an average of 127 days, up from 56 days in 2025.

92.6% of open-source users reported that their organization was aware it was vulnerable before the cybersecurity incident occurred.

When open source using organizations were asked if they took steps to improve its patch and vulnerability management processes in the last 12 months, 44.8% said they conducted security training.

When open source using organizations were asked if they took steps to improve its patch and vulnerability management processes in the last 12 months, 23.0% said they increased IT security staff.

When open source using organizations were asked if they took steps to improve its patch and vulnerability management processes in the last 12 months, 18.4% said they adopted AI/machine learning.

48.5% of surveyed organizations said there was no change in the last 12 months in the time required for patching a critical or high-priority Linux vulnerability once it was detected.

Only 1% of organizations said they decreased the time required for patching a critical or high-priority Linux vulnerability after it was detected.

When open source using organizations were asked if they took steps to improve its patch and vulnerability management processes in the last 12 months, 63.2% said they reviewed/updated internal vulnerability management processes.

42% of SMB respondents say AI cyberattack speed makes traditional human-driven patching and response times effectively obsolete.

Among the open-source users whose organizations reported a cybersecurity incident, 61.4% indicated that the incident occurred when a patch was available but had not been applied – a slight increase from 60.4% last year.

Among respondents who identified at least one affected technology, vulnerabilities tied to reported open source incidents were distributed across infrastructure and middleware (51.9%), software development frameworks and libraries (50.0%), and databases and data technologies (48.1%).

When open source using organizations were asked if they took steps to improve its patch and vulnerability management processes in the last 12 months, 68.8% said they increased automation.

41% of successful Canadian software buyers considered patching and update practices before purchase.

25% of organizations take between 8 and 30 days to apply critical patches.

73% of organizations take longer than 24 hours to apply critical patches.

Patching and updating systems consumes 13.9% of Managed Service Provider (MSP) technician time.

30% of organizations surveyed believe that patching strategy for OT devices must be understood better to properly secure OT.

Critical patching for PCs running Windows 10 and 11 is delayed nearly two months on average across organisations.

Critical patching for PCs running Windows 10 and 11 is delayed nearly two months on average across organisations.