Back to Basics: Security First

Summary

Emergency patches are exposing which companies have real operating discipline and which only have policy binders. This article looks at what that means for owners, sellers, and buyers over the next 18 months.

What this week’s emergency patches reveal about the next 18 months for owners, buyers, and sellers.

It’s 6:00 a.m. The clock radio flips over. Same song. Same snow. Same slushy puddle waiting at the curb.

If you’ve seen Groundhog Day, you know the drill. Phil Connors, a weatherman with a bad attitude, gets stuck living February 2nd over and over in Punxsutawney, Pennsylvania. Every morning he wakes up to the same song, runs into the same people, and steps in the same puddle. Eventually he takes it out on the clock radio. It doesn’t help. The next morning, it’s there again.

Now picture your IT team last Sunday.

On October 13, Microsoft’s monthly security fixes arrived. Your team patched everything, tested it, and went home feeling like heroes. Somebody probably brought donuts.

Twelve days later, on a Sunday morning, the clock radio flipped over. Microsoft released emergency fixes for .NET, the software a large share of business applications run on, and told everyone to install them even if they had already patched on the 13th. Why? Two of the October fixes didn’t fully fix what they were supposed to fix.

That’s not a patch. That’s a puddle.

Somewhere on Sunday, an IT director read that notice, looked at the donut box, and said a word I can’t print in this article.

This one is for three people. The owner running a company. The owner getting ready to sell one. And the buyer or investor on the other side of that deal. Same Sunday, three very different problems. I’ll get to each of you before we’re done.

Here’s the part that matters to a CEO. Some companies shrugged and got it done. They had an emergency patch process, they had tested it, and within hours they were updating firewalls, servers, and laptops. Sunday was a long day for them. Nothing more.

Everyone else spent Sunday figuring out who owned what, which systems even ran .NET, and whether the fix would break payroll. For them, Sunday was the first day of a long month.

Same emergency. Two very different bills. And I expect we’ll see a lot more Sundays like this one over the next 18 months.

Even the AI people are saying it

Last week Jason Clinton, Anthropic’s deputy chief information security officer, posted something on X that I’d frame and hang in every boardroom in America: “Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. Not for AI, for the basics.”

His estimate is that we need to hold on for about 18 months while AI finds software holes faster than companies can patch them.

Sit with who’s saying that. A company that builds AI is telling you the answer isn’t more AI. It’s patching, access control, backups, and knowing what’s actually on your network. The boring stuff. The stuff nobody holds a ribbon cutting for.

I’ve spent 25 years doing thousands of independent assessments. I have never found a company that was clean. Not one. And what I find is almost never exotic. It’s the basics, done halfway.

Here’s the conversation I have more often than any other.

“Do you have a patch policy?”

“Absolutely.”

“When did you last test how fast you can push an emergency fix to every system?”

Long pause.

That pause is where the money goes.

The bill came due in Japan

Two Japanese companies showed us this week what the pause costs.

GMO Internet Group runs a cloud service that currency traders use to run automated trading around the clock. Attackers got in, grabbed the traders’ logins, and started placing trades the customers never made. Then they asked for $50 million in crypto. GMO said no, and I respect that. The stock still dropped almost 16% in one trading session. The service has been shut down since October 21, and GMO is now covering customers’ trading losses plus a goodwill payment to every user. The $50 million ransom is turning out to be one of the smaller numbers in the story.

The same week, Park24 announced a 5.5 billion yen extraordinary loss after a breach of its car-sharing service compromised roughly 6.6 million user accounts.

Neither of those numbers was in anybody’s budget. They never are.

Six more weeks of winter

Every February, Punxsutawney Phil checks for his shadow and tells us whether we get six more weeks of winter.

Moody’s just put out a forecast of its own, and it isn’t about the weather. Half the vulnerabilities attackers are actively using are still open 87 days after they’re disclosed. Meanwhile, the average time from disclosure to first attack dropped to 44 days in 2025.

Do the math. The attackers show up about six weeks before most companies get around to the fix. Six more weeks of winter, and you’re standing outside in your shirt sleeves.

And that data was collected before AI started speeding the attackers up.

The companies that closed the .NET gap in hours didn’t have magic budgets. They had a process before Sunday, and they had practiced it. I call that being brilliant at the ordinary.

A binder is not a fire drill

Compliance should be the result of good security. It should not be the measuring stick.

When security comes first, roughly 80% of a typical compliance requirement takes care of itself. When compliance comes first, you get a nicely formatted document that says you have a patch policy. What you don’t get is proof that you can update every firewall, server, and laptop over a weekend when the vendor’s first fix doesn’t work.

A fire extinguisher on the wall passes inspection. It doesn’t tell you whether anybody knows how to pull the pin.

Grant Thornton just surveyed 1,100 business leaders, and the results read like a confession:

• 74% say cyber incidents are the biggest threat to their company’s performance over the next two years.
• Only 49% are highly confident they’d even detect an advanced attack.
• 61% say their risk teams are so disconnected they don’t have a complete view of their own risk.

Read that again. Three out of four say cyber is the biggest threat. Half aren’t sure they’d see it coming. I’d bet most of them passed their last audit.

Tony Buffomante, who leads cyber and risk advisory at Grant Thornton, put his finger on why: “Many organizations still manage cyber, compliance, fraud and audit risks through separate teams and disconnected data. That’s creating blind spots at exactly the moment AI is making threats faster and harder to detect.”

Your vendors have keys to the house

Earlier this year I presented the ProcessUnity and Ponemon Institute study on third-party risk, built on 1,465 risk leaders and practitioners. The numbers still make a room go quiet.

• The average company has 12 third-party breaches a year. That’s one a month.
• Ninety percent had at least one.
• The average company reviews only about a third of its vendors.
• At 64% of large companies, a single vendor review takes more than four months.
• 27% of vendors never answer at all.
• Only 16% of companies fix most known vendor problems before they sign the contract.
• 18% fix none of them.

That’s like changing every lock on the house and leaving a spare key under the mat for every contractor who ever did a job for you.

PwC found that out this week. Reuters reported that PwC confirmed an incident at a vendor that hosts its employee training records, after an extortion group claimed it took 590 gigabytes. PwC says no client data was involved. Fair enough. But the door was a vendor’s.

And every time Microsoft says “patch now,” every one of your vendors has to patch too. On their schedule, not yours.

So what do you do Monday morning?

If you run the company, ask one question: “When did we last test our emergency patch process, and how long did it take to reach every system?” If nobody can give you a date and a number, you just found your first project.

If you run a smaller company, don’t assume you’re too small to notice. NordLayer reports ransomware hit an all-time high last quarter, up 50% from a year ago, and businesses with fewer than 200 employees and under $25 million in revenue, especially manufacturers, are the most frequent targets.

And before you lean on your cyber insurance, read it. Remember Ned Ryerson, the insurance guy Phil can’t get away from on the sidewalk? He’d write you a policy on the spot. Read it first. According to the NAIC, nearly two-thirds of U.S. cyber policies are add-ons attached to other business policies, often with narrower coverage and lower limits. Worldwide, only about 1% of cyber losses are insured. The other 99% comes out of somebody’s pocket.

If you’re getting ready to sell, the buyer is reading the same headlines you are. Show up with records of how fast your last emergency fix reached every system, and you take away a reason to lower the price. Show up with a compliance certificate and nothing else, and expect more questions, a bigger escrow, or a smaller number. Do the same homework on your critical vendors, and do it before you go to market, not in the middle of diligence.

If you’re buying, ask for evidence, not policies. “When the October .NET fix came out, how long did it take you to close the gap, and how do you know?” Then ask the same about the target’s key vendors. If the target looks like the typical company in the ProcessUnity study, about two-thirds of its vendors have never been reviewed. That risk becomes yours the day you close.

How Phil got out

Here’s what I love about Groundhog Day. Phil doesn’t escape by finding a loophole. He tries that. It doesn’t work.

He gets out by getting good at ordinary things. He learns the piano. He learns the town. He shows up every day and does the work, until he’s ready for whatever February 2nd throws at him.

That’s the playbook for the next 18 months. No silver bullet. No shiny new tool. Just the basics, practiced until they’re boring.

The alarm is going to keep going off. The companies that protect their value will be the ones that already know what to do when it does.

Proof over checkboxes. It’s not what your policy says. It’s what you can prove.

Sources: Microsoft; Reuters; Euronews; Investing.com; Jiji Press via Nippon.com; Moody’s via Infosecurity Magazine; CNBC; Grant Thornton 2026 Cyber & Risk Survey via CFO.com; ProcessUnity and Ponemon Institute, State of Third-Party Risk Assessments 2026; NordLayer; NAIC 2026 Report on the Cybersecurity Insurance Market.