BUSINESSCompanies · · 2 min read · Source: Microsoft Windows Experience Blog
Microsoft: AI finds more Windows flaws, but companies patch too slowly
On November 5, 2026, Microsoft described how AI agents now find security vulnerabilities in Windows and help fix them. The October update addressed more than 1,100 vulnerabilities, Microsoft says, and many business devices take weeks to install such updates.
My tool tip · AdWispr Flow – AI dictationTry it free
Key facts
- On November 5, 2026, Microsoft said AI agents (the MDASH scanner) find Windows flaws and help fix them.
- The October 2026 update fixed more than 1,100 Windows vulnerabilities, according to Microsoft.
- Microsoft data shows fewer than half of business devices had the update after two weeks; about a quarter still lacked it after four.
AI searches, people decide
According to Microsoft's blog post, the company uses an agentic code scanner called MDASH. It combines several AI models and specialized agents that find and validate potential flaws. AI then helps engineers assess impact, find related variants, test fixes and carry them back to older Windows versions. Final decisions stay with the engineers, Microsoft says.
More flaws doesn't mean less secure
The effect is visible: the October 2026 monthly security update fixed more than 1,100 registered vulnerabilities (CVEs) in Windows, per Microsoft. The company stresses that a higher count doesn't mean Windows is less secure; more is simply being found. The monthly patch schedule stays the same, the post says.
The real problem: the gap after release
The most important number comes later. Microsoft's diagnostic data from a sample of enterprise devices in August 2026 showed fewer than half had installed the security update two weeks after release. About one in four was still unpatched after four weeks. Microsoft's recommendations:
- stay on supported Windows versions and install updates promptly
- use Windows Autopatch via Intune for staged rollouts
- use hotpatching on eligible devices so security updates apply without a restart
- patch internet-facing systems, identity infrastructure and high-value machines first
Microsoft sees extended security updates for old versions as a bridge, not a long-term fix.
What this means for you
- AI speeds up finding flaws, for vendors and attackers alike.
- The bottleneck is no longer the patch but its installation inside companies.
- Small businesses without IT staff need automatic updates, not manual work.
How to use this
Turn on automatic Windows updates and plan one fixed restart per week. If you manage several PCs, check that all run a supported Windows version.
Luigi's take
Several stories this week pointed the same way: AI models find security flaws faster than ever. Microsoft's post shows the other side. If a quarter of business PCs are still unpatched after four weeks, the fastest discovery doesn't help much. Attackers use the same tools, and the window keeps shrinking.
My advice, especially for freelancers and small teams: turn on automatic updates and schedule one fixed restart a week instead of postponing updates. If you look after a few machines, check that all of them still run a supported Windows version. It's unexciting, but it protects you more than any new security tool.
Source
Microsoft Windows Experience Blog: A new standard for vulnerability management in the AI era
This article was researched and written with AI assistance. Responsible: Luigi Lugmayr.
DealPDFelement Black Friday: what 'up to 84% off' really saves
NewsMicrosoft: AI finds more Windows flaws, but companies patch too slowly
NewsGermany's data centers could double their water use by 2030