AI is helping software makers find security flaws faster than ever, and the fixes are landing on your devices. Here’s what’s going on and how to keep up without losing your mind.
If it feels like your laptop, phone, and browser have been asking you to update and restart constantly over the last couple of months, you’re not imagining it. Microsoft, Google, and Apple are all releasing security fixes in larger batches and on faster schedules than they were even six months ago. The main reason is artificial intelligence, though not in the way you might think. It isn’t about the AI tools your staff use. It’s about how software companies and, unfortunately, attackers are using AI to find weaknesses in the software everyone already relies on.
Why are there so many more updates?
For decades, finding security flaws in software was slow, skilled, human work. That’s changed quickly. Software companies are now pointing AI tools at their own code, including code that’s been sitting quietly in Windows or Office for years, and those tools are turning up problems at a pace no team of human researchers could match.
The numbers from the past few months tell the story:
- Microsoft fixed about 570 security vulnerabilities in its July update, a record at the time, and said plainly that AI-assisted discovery was the reason. Its Windows leadership told customers to expect “a higher volume of security updates” going forward. By September, the monthly release had grown to more than 970 fixes, the largest in the history of the program.
- Google said that two recent versions of Chrome fixed more security bugs than the previous 23 versions combined. It has moved Chrome to two security releases per week and shortened its major release cycle.
- Apple has started shipping security fixes on their own, ahead of its bigger operating system updates, because AI can shrink the time between a flaw being found and someone exploiting it “from days to hours.”
The same AI tools that help software makers find flaws can help attackers find them, too. And once a fix is published, attackers can study it to figure out what was broken, then go looking for anyone who hasn’t installed it yet. Security researchers are now reporting that the gap between a vulnerability becoming public and attackers using it can be less than a day.
So the software companies are doing the reasonable thing: fixing more, faster, and pushing those fixes out to you as soon as they can.
Does this mean things are more dangerous than before?
Not exactly. One security analyst put it well when describing Microsoft’s September release: AI is creating “larger haystacks, but it isn’t finding more needles.” Most of these fixes address flaws that were already there and are now being caught and closed. Your software is getting safer.
The risk is in the gap. A device that’s two or three weeks behind on updates used to be a modest concern. With exploit timelines shrinking to hours, that same device is a much more attractive target. For nonprofits, where staff are often stretched thin and a laptop may sit closed in a bag for a week of site visits, that gap can open up without anyone noticing.
It also means your IT team, or your IT provider, is handling far more patches than a year ago. More updates means more testing, more chances for an update to clash with a program you rely on, and more restarts to coordinate.
What should your staff do?
The most important habits are simple, and they don’t require anyone to become a security expert.
- Restart when asked, or at least once a week. Many updates, especially browser updates, download in the background but don’t take effect until you restart. A laptop that’s been “sleeping” for a month isn’t protected by the fixes it downloaded.
- Don’t snooze updates indefinitely. It’s fine to finish your meeting first. It’s not fine to click “remind me tomorrow” for three weeks.
- Update your phone, too. Staff phones that access email and shared files need the same attention as laptops.
- Check in after time away. If a laptop has been off during a vacation or a stretch of field work, connect it, let it update, and restart before diving back in.
- Tell someone if an update breaks something. With this many updates, the occasional hiccup is more likely. Reporting it quickly helps your IT support fix it for everyone.
What should your organization do?
For leaders and whoever manages IT at your organization, a few things are worth a fresh look:
- Make sure updates are managed centrally, not left up to each person. Tools like Microsoft Intune can push updates, set deadlines for restarts, and show you which devices are falling behind.
- Know what’s out of date. Ask your IT provider for a simple report of devices that are behind on updates, and make it a regular part of your check-ins.
- Plan for devices that can’t keep up. Older computers that no longer receive security updates are a bigger liability now than they were a year ago. This is a good reason to keep your replacement schedule current.
- Set expectations with staff. A short note explaining why the updates are coming so often goes a long way toward getting people to cooperate with restarts.
What about volunteers, consultants, and personal devices?
Many nonprofits rely on people who aren’t using an organization-owned computer: volunteers, board members, part-time contractors, and sometimes staff on their own phones. Those devices were already a blind spot, because you can’t see or manage their updates. With fixes coming faster and attackers moving faster, an out-of-date personal device is a bigger risk than it used to be.
You don’t need to lock everyone out. A few practical steps go a long way:
- Give access by role, and take it back when the role ends. Volunteers and contractors should have only the access they need, for only as long as they need it. Build removing access into your offboarding, even for a one-season volunteer.
- Keep data in your systems, not on their devices. Where possible, have people work in web-based tools rather than downloading files or syncing organizational data to their own laptops.
- Require up-to-date devices where you can. Ask your IT provider whether you can require a device to be current on updates before it connects to email or shared files.
- Provide a managed device for sensitive work. For volunteers who handle donor, client, or health information, an organization-managed laptop may be worth the cost.
- Include updates in onboarding. A simple “keep your device updated and restart regularly” expectation, shared when someone starts, sets the tone.
- Don’t forget consultants and outsourced staff. A part-time accountant, grant writer, or fundraising consultant often has access to your most sensitive financial and donor information, on a device you don’t manage, and may be working for several other organizations at the same time. Give each person their own login rather than a shared account, share files through your systems instead of email attachments, and ask about their security and update practices. For ongoing relationships, it’s reasonable to put those expectations in the contract.
How Community IT handles this for our clients
For our managed services clients, we handle patching as part of our ongoing support. We test and approve updates, roll them out on a schedule designed to minimize disruption, prioritize fixes for vulnerabilities that are being actively exploited, and follow up on devices that fall behind. The volume has gone up considerably this year, and our team has adjusted to keep pace so you can have peace of mind that your systems are protected from all the latest vulnerabilities.
This is the new normal, and that’s OK
None of the major software companies expect this to slow down. As AI tools get better at finding flaws, the flow of fixes will likely keep growing, at least for a while. The organizations that come through it well won’t be the ones with the fanciest security tools. They’ll be the ones where updates happen reliably, restarts aren’t a battle, and someone is keeping an eye on the devices that fall behind.
If you’d like help getting a handle on patching at your organization, or you’re not sure how far behind your devices are, let’s talk.
As advocates for using technology to work smarter, we’re practicing what we recommend. This article was drafted with the assistance of AI, but the content was reviewed, edited, and finalized by a human editor to ensure accuracy and relevance.
Photo by Herry Sucahya on Unsplash