The Pulse
Microsoft Says It Is Using AI Across Windows Vulnerability Management
According to diagnostic data from August 2026, fewer than half of devices in a measured Windows enterprise sample had installed the security update two weeks after release, Microsoft says. The company describes AI tools for vulnerability di
AI.info Team · Written with AI · fact-checked ·
Fewer than half of devices in a measured Windows enterprise sample had installed the security update two weeks after its release, Microsoft says. About one in four still had not installed it after four weeks. The figures come from diagnostic data from August 2026. Microsoft describes the time between an update becoming available and reaching devices as part of an organization’s security posture.
Microsoft says it is using AI in vulnerability discovery
Microsoft says AI can help defenders find and fix vulnerabilities earlier, while also helping attackers search for weaknesses before fixes are available and analyze fixes after release. The company says it has continued to advance this work across vulnerability discovery, remediation, validation and deployment. Its stated aim is to identify meaningful vulnerabilities earlier and make findings more actionable, not simply to find more issues.
One tool in that work is MDASH, an agentic code scanner that uses multiple AI models and specialized agents to find and validate potential vulnerabilities. Microsoft says its security and engineering teams review the findings and decide how to respond. The company says engineers remain responsible for reviewing AI-assisted remediation work, making engineering decisions and owning the final output.
Microsoft says engineers review AI-assisted remediation work
Microsoft says AI assistance helps engineers assess a vulnerability’s impact, identify affected Windows versions and locate variants in related code. It can also help evaluate remediation options, develop backport strategies for different Windows versions, and build security and regression tests. The company says Windows validation draws on internal flighting, functional testing, security proof-of-concept testing and application compatibility testing.
Microsoft says validation also includes validation with OEMs, security vendors, ISVs and customers through the Security Update Validation Program. It says it uses AI-assisted capabilities for test selection, test creation, triage, analysis and reporting. Microsoft says optional non-security preview updates let organizations install update content on select devices before it becomes part of the following month’s security update.
Microsoft says October’s update addressed more than 1,100 Windows CVEs
Microsoft says the October 2026 monthly security update addressed more than 1,100 Common Vulnerabilities and Exposures for Windows. The company cautions that the CVE count alone does not tell the full story: it says AI lets its teams examine more code more deeply, while researchers continue to report vulnerabilities and Microsoft prioritizes fixes as they are identified.
Microsoft says it publishes CVE information for vulnerabilities it addresses, whether reported by external researchers or identified by its own teams and AI systems. It says its Security Update Guide provides details on severity, impact, exploitability and guidance for each CVE. The company says it also makes the data available in machine-readable formats, including Common Security Advisory Framework advisories, Vulnerability Exploitability eXchange documents and an API.
Microsoft links protection to deployment speed
Microsoft says attackers might be able to analyze a published fix to understand the vulnerability and develop an exploit, potentially within hours. After an update ships, the company says it monitors diagnostic data, rollout reporting, customer support inquiries, and feedback from social channels and forums. Automated systems help correlate those signals for engineering investigation, and engineers validate potential issues before determining a response.
Microsoft identifies Windows Autopatch through Microsoft Intune as an update-management option for Windows 11, with staged deployments and reporting. It says that for eligible devices, hotpatching can apply monthly security updates without a restart, while standard cumulative baseline updates are required periodically. Microsoft says Windows Server 2025 supports hotpatch updates across eligible Azure, Azure Local and Azure Arc-connected environments, with Azure Update Manager providing patch orchestration.