Short answer
Unpatched software is now reported to be the leading way attackers get into organizations, ahead of stolen passwords. Verizon’s 2026 Data Breach Investigations Report reportedly found that exploiting software flaws started 31% of breaches, compared with 13% for credential abuse. In plain terms, attackers use a known bug in software that nobody has updated. Phishing still matters for small firms, so this is a second front rather than a replacement. Insurers often ask about patching, and policy wording varies, so review the actual terms.
What unpatched software means
Software makers regularly find flaws in their products and publish fixes, called patches. An attacker can read the same announcement and look for systems that have not applied the fix. If a firm’s software is still running the old version, the flaw stays open.
Reports suggest AI is shrinking the time between a flaw becoming public and attackers using it. The gap that once took months may now be much shorter. A plan to update next month may therefore leave a door open longer than it used to.
What the 2026 breach report reportedly found
Secondary coverage of the Verizon report describes exploitation of vulnerabilities as the top way in for the first time in the report’s history. The same coverage reports that only a minority of known-exploited flaws were fully fixed, and that fixes took a median of several weeks. Humans were still involved in most breaches.
Please check these figures against the original Verizon report before relying on them. The data covers breaches across many industries, so it does not predict what will happen to any one firm.
What is most at risk at a design firm
Architecture and engineering firms often run a small set of systems that rarely get attention. The usual ones include:
- VPN and remote-access devices. These face the internet, so attackers can find them easily.
- Firewalls. Older firmware can contain known flaws.
- The website. Plugins and themes need regular updates.
- Old copies of software. One workstation running an outdated version can be enough.
A firm with an outside IT provider or a principal who handles IT on the side may not have a clear schedule for any of these.
Real-world example
Consider a hypothetical 11-person engineering firm. A principal handles IT between projects. The firm’s remote-access device has not been updated in a year, and an update notice has sat unread since spring.
A vendor announces a flaw in that device and releases a fix. Automated tools begin scanning for devices that have not applied it. The firm’s device shows up, and an attacker gets in before anyone reads the notice.
The firm did nothing unusual. It simply had no routine for applying updates quickly.
What to do about unpatched software this month
Small firms can start with a few steps:
- Turn on automatic updates for computers, software and the website where possible.
- Ask your IT provider how quickly they apply fixes marked critical.
- List the devices and software that face the internet, so someone owns each one.
- Retire or update old copies of software on single workstations.
- Install endpoint detection and response (EDR) software on every computer.
The phishing and IT security checklist covers installing updates automatically and putting EDR on every computer. For a free reference, CISA publishes a catalog of known exploited vulnerabilities that IT providers can use.
Why underwriters ask about patching
Many cyber applications ask how a firm applies updates and whether it uses EDR. Carriers ask because missing updates are a common starting point for incidents. Answers also affect how a carrier views the firm, and wording and requirements vary by carrier.
Answer accurately. The cyber application shows the kinds of questions firms are typically asked, and fixing the basics first often makes the answers easier.
What to check in your firm
Firms may want to review:
- Whether automatic updates are on for computers and software.
- Whether anyone owns the VPN, firewall and website updates.
- How quickly the IT provider applies critical fixes, and whether that is in writing.
- Whether EDR runs on every computer.
- Whether the firm could answer the patching and EDR questions on a cyber application.
Hardcover insight
Firms often assume stolen passwords are the main risk and stop there. Passwords and email scams still matter, but software updates now need the same attention. The fix is rarely expensive. It usually comes down to deciding who owns updates and checking that they happen.
Related questions
Is unpatched software now the top way attackers get in?
Verizon’s 2026 report reportedly says so, with exploitation ahead of credential abuse. Confirm the figures against the original report before relying on them.
Does this mean phishing is no longer a risk?
No. Most small-firm incidents still start with email. Unpatched software adds a second front.
What does exploiting a vulnerability mean?
It means an attacker uses a known flaw in software that has not been updated. The fix is usually already available.
How fast should critical updates be applied?
Faster is better. Ask your IT provider how quickly they apply critical fixes and get the answer in writing.
Why does a cyber application ask about patching?
Missing updates are a common starting point for incidents. Carriers use the answers to understand how well a firm manages that risk.