The episode identifies a structural shift: traditional patching is no longer sufficient protection as the act of releasing a patch now informs and accelerates attackers, particularly with the use of AI. When vendors publish fixes, attackers can promptly identify and exploit not-yet-patched systems at scale. Companies and data sources underlying this shift include OpenAI, Microsoft, CISA, and the Verizon 2026 Data Breach Investigations Report.
The most consequential development is Verizon’s finding that vulnerability exploitation now leads breach causes at 31%, overtaking credential theft and phishing. The percentage of fully remediated exploited flaws has declined to 26%, and the average time to fix has increased. Notably, 263,000 servers in the U.S. still run unsupported PHP, and coordinated AI-driven attacks have reduced attacker dwell time to hours in real-world incidents like the ConnectWise breach.
Vendor responses illustrate the risk landscape. N-able has launched AI-assisted patching to speed remediation and scale endpoint management, but its patching platform was itself compromised. Industry observers such as Krugman and Thompson foresee a move away from open internet-facing systems toward closed or gated platforms, accepting slower workflows as a tradeoff for reduced exposure.
For MSPs and IT service providers, the implication is clear: the key operational metric is not patching speed or compliance, but minimizing clients’ internet-exposed assets. Providers should classify all client-facing resources, move critical services into platforms with pre-release patching or behind access controls, and focus quarterly reporting on reducing the attackable surface. Patching remains a backstop, but accountability shifts to exposure reduction as both attackers and defenders automate.
00:00 We Can’t Patch All the Bugs
03:39 Every Fix Starts the Race
05:53 Run Faster or Leave the Race
09:33 Why Do We Care?
Supported by:
HaloPSA
Mailprotector
CouchDrop.io(Oveka)
About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.
💼 All Our Sponsors
MSP Radio is supported by our partners:
ABC Solutions · CometBackup · Firetail · Guardz · HaloPSA · LogMeIn · Mailprotector · Oveka · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI
Supporting the IT services community through insights, analysis, and transparency.
🚀 Join Business of Tech Plus
Get exclusive access to investigative reports, vendor analysis, leadership briefings, and more.
👉 https://businessof.tech/plus
🎧 Subscribe to the Business of Tech
Want the show on your favorite podcast app or prefer the written versions of each story?
📲 https://www.businessof.tech/subscribe
📰 Story Links & Sources
Looking for the links from today’s stories?
Every episode script — with full source links — is posted at:
🌐 https://www.businessof.tech
🎙 Want to Be a Guest?
Pitch your story or appear on Business of Tech: Daily MSP News & IT Services Analysis
💬 https://www.podmatch.com/hostdetailpreview/businessoftech
🔗 Follow Business of Tech
LinkedIn: https://www.linkedin.com/company/28908079
YouTube: https://youtube.com/mspradio
Bluesky: https://bsky.app/profile/businessof.tech
Instagram: https://www.instagram.com/mspradio
TikTok: https://www.tiktok.com/@businessoftech
Facebook: https://www.facebook.com/mspradionews
Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
