Why is patching so darn hard? CINS Brief October 2026
Our Take
AI Is Fast. Patching Isn’t.
It's fairly obvious the narrative this month is all about the volume and velocity of AI attacks, particularly on the edge of the network. The best defense still seems to be old-school patching ... Here's the problem though: Every time we speak to people at a conference about patching as the obvious solution, we're met with smirks or rolling eyes, because it's just never as easy as it seems. There are two ways to deal with this, and they're not mutually exclusive: First, do what we do. Put something out in front of these vulnerable devices to protect them. And second, the market is ripe for someone who can make patching simple and easy, if that's even a thing.
Featured Article
15 Years of CINS Army: The State of Cyber Threat Intelligence in the Age of AI
In 2011 we started publishing a free, hourly list of bad IPs. Fifteen years later, CINS Army is downloaded hundreds of thousands of times a day, and attackers now move from initial access to hand-off in 22 seconds. Ted looks back at what CINS has taught us and why intelligence only matters if it is timely, collective, and acted on.
In Other News
- Malware evasion made easier with AI — but behavior still gives it away (CSO Online)
- AI Guardrails Aren’t Stopping Criminal Hackers (Wired)
- Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds (Infosecurity Magazine)
- DDoS attacks can knock services offline before links reach capacity (HelpNet Security)
- Report Surfaces Sharp Increase in Malware Detections (Security Boulevard)
- Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network (SecurityWeek)
