More than a fifth of senior UK security leaders say they have called in sick or booked leave to avoid Patch Tuesday, according to a new Socura survey. With Microsoft’s monthly fix count recently approaching a thousand CVEs, the findings point to a resourcing and retention problem that boards can no longer treat as a purely technical matter.
What happened
Socura, a UK managed detection and response provider, has released research based on a poll of 500 UK chief information security officers, chief security officers and heads of IT security. The headline figure is stark: 22% admitted they had either phoned in sick or deliberately taken holiday so they would not have to be at work on Patch Tuesday, the second Tuesday of each month when Microsoft, Adobe and other vendors push out their security updates.
The rest of the data paints a picture of a workload that spills well beyond the working day. Some 41% of respondents said they had put in overtime to get through the patching cycle, and 37% said they had stayed late specifically to deploy updates. Nearly three in ten (29%) described feeling significant anxiety on the evening before Patch Tuesday, and the same proportion said they were more short-tempered with colleagues or family during patch week. A further 43% told Socura they cannot take time off without facing a heavy backlog of stress when they come back.
The research, reported by Infosecurity Magazine and Cybernews on 13 October 2026, landed on the second Tuesday of October, which is itself a Patch Tuesday. Socura chief executive Andrew Kays said the results reflect “unhealthy levels of stress and burnout in our industry”, and called for security teams to be properly resourced and supported on patch days.
The detail
The pressure behind these numbers is not hard to find. Microsoft’s September 2026 release was the largest Patch Tuesday on record, although the exact total depends on who is counting and what they include. Tenable put the figure at 964 CVEs, 104 of them rated critical, while Infosecurity Magazine reported 974 and BleepingComputer 966. Ars Technica’s tally rose to 997 once Chromium fixes carried into Edge were added. Whichever number you prefer, it dwarfed July’s previous record of around 570 and included two actively exploited Windows flaws.
Press coverage of the survey links the surge to AI-assisted vulnerability research, which is helping vendors and researchers find flaws far faster than before. That helps software quality over time, but today it lands on the same finite teams who must test and deploy every fix within maintenance windows that have not grown.
The survey is not entirely gloomy about technology. Around 40% of respondents said AI was taking repetitive work off their teams’ plates, and 37% said it was helping them defend core infrastructure against live threats. The findings also sit alongside earlier research: a Seemplicity study in March 2026 found that 45% of security leaders work at least 11 extra hours a week.
It is worth being clear about what this is. It is vendor-commissioned research from a company that sells managed security services, and the methodology published so far is limited to the sample size and job titles. The figures should be read as a strong signal rather than a definitive census of the UK profession.
Why it matters for UK organisations
For UK businesses, this is a workforce story with a direct security cost. The senior people who decide which patches go first, sign off emergency changes and brief the board are precisely those reporting that they dread, and sometimes dodge, the busiest day of the month. When the decision maker is absent, prioritisation drifts to whoever is on shift and risk decisions get delayed.
Retention is the second issue. The UK cyber labour market is already tight, and the government’s latest cyber skills labour market study found that 57% of UK businesses now have a basic technical skills gap, up from 49% a year earlier. Losing an experienced security lead to burnout means months of recruitment, reduced oversight and often a higher salary bill: a balance sheet issue, not just a wellbeing one.
There is also a regulatory dimension. The Cyber Security and Resilience Bill, now before Parliament, is set to place clearer expectations on managed service providers and operators of essential services around timely risk management. Patch discipline is one of the first things a regulator or insurer will ask about after an incident, and “our CISO was off that week” is not a defence anyone wants to offer.
Expert view
None of this surprises me. In my experience, Patch Tuesday stress rarely comes from the patches themselves. It comes from the lack of a repeatable process: no agreed fast-track criteria, no pre-approved change window, no reliable asset inventory, and one senior person holding every decision. When we test organisations after a breach, the unpatched system that let the attacker in is very often one nobody knew they owned.
The volume problem is real, but a thousand CVEs does not mean a thousand urgent actions. Most organisations are exposed to a fraction of any month’s fixes, and only a handful will be internet facing, actively exploited or sitting on high-value systems. The teams that cope best do that triage in advance, so patch day is execution rather than a scramble.
I would also push back on any suggestion that AI will simply absorb the extra load. Automation helps with ticketing, testing and deployment, but someone still has to own the risk decision. That ownership needs to be shared, documented and resourced, not concentrated in one exhausted individual.
What to do now
- Write a patch policy that does the triage for you. Define in advance what counts as urgent: known exploited, internet facing, critical rating on key systems. Cyber Essentials already requires high and critical updates to be applied within 14 days of release, so use that as your baseline and go faster for anything under active attack.
- Fix the asset inventory first. You cannot prioritise what you cannot see. An accurate list of devices, software and owners underpins the Cyber Essentials security update management control and makes patch day far less chaotic.
- Pre-approve change windows. Agree standing windows with the business so downtime is not renegotiated monthly.
- Remove single points of failure. Make sure at least two people can authorise emergency changes and accept risk, and rota senior cover so leave around patch week is normal, not frowned upon.
- Automate the routine. Use staged rollout and automated testing rings for endpoints, keeping specialist effort for servers, network kit and core business systems.
- Put workload on the risk register. Track overtime and on-call load for the security team and report it to the board alongside technical risk, so resourcing is discussed before someone burns out.
Bottom line
Socura’s figures are vendor research and should be read with that in mind, but they describe something many UK security teams will recognise. Patch volumes are climbing fast, and organisations that rely on a few senior people to absorb that pressure through late nights are building fragility into their defences. Clear priorities, shared ownership and proper resourcing will do more for patch compliance than another heroic Tuesday.
Sources
- Infosecurity Magazine: Fifth of CISOs Take Time Off to Avoid Patch Tuesday
- Cybernews: Patch Tuesday stress pushes cyber leaders to call in sick
- Privacy Needle: UK CISOs Avoid Patch Tuesday Over Stress and Workload
- GOV.UK: Cyber security skills in the UK labour market 2026
- Tenable: Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs
- Let’s Data Science: Microsoft’s September Security Updates Set a Record as Counts Vary by Scope
