AI-driven cyberattacks are accelerating vulnerabilities and forcing the military to choose between risk and downtime
The humble software patch has become a major challenge and a growing operational problem for Pentagon and defense industry networks. The surge in artificial intelligence-enabled cyberattacks is accelerating the discovery of vulnerabilities, the release of security fixes and the pressure placed on cybersecurity teams.
At a defense information systems conference, several officials warned that vulnerabilities are being identified and exploited faster than ever. At the same time, software vendors are issuing fixes at an unprecedented pace, while government networks cannot be taken offline every time an application requires an update.
Security teams are operating at unprecedented speed
Roger Greenwell, chief information officer of the Defense Information Systems Agency, described a cycle that is placing increasing pressure on personnel responsible for applying patches.
Adversaries are using new capabilities to search for weaknesses in government software, defense industry products and widely used commercial applications. Meanwhile, vendors are examining their code more deeply, identifying vulnerabilities and releasing security fixes at a rate not previously seen.
The challenge is not simply receiving patches. Organizations must ensure that updates are applied across every relevant system. Security teams are being pushed to work rapidly in an effort to stay ahead of attackers without disrupting mission operations.
Critical networks cannot be shut down indefinitely
Installing a patch can interrupt systems supporting intelligence, communications, command and control, and other essential missions. Many of these networks cannot easily tolerate extended periods of unavailability.
As a result, defense organizations are increasingly turning to resilient architectures and technologies capable of applying security updates dynamically, with little or no advance notice.
The goal is to repair systems almost immediately while avoiding lengthy outages and preventing each software update from becoming an operational crisis.
Officials are accepting risks once considered unacceptable
Colin Hankey, the State Department’s chief information officer, who also oversees the department’s element within the Intelligence Community, said the accelerating pace of patching is changing the way cyber risk is assessed.
The volume of security alerts and the frequency of software updates sometimes force officials to accept more risk than they would have tolerated in the past. There is not always enough time to fully determine how a patch might affect ongoing operations.
The choice is increasingly stark: apply a fix quickly without knowing all of its operational consequences, or leave a known vulnerability exposed and potentially available to adversaries.
The central question is no longer only, “What happens if we install the patch?” It is also, “What risk do we accept by not installing it?”
A patch does not always solve the vulnerability
Another complication is that a patch does not automatically guarantee that a vulnerability has been fixed.
In one case described by the Defense Intelligence Agency’s technology leadership, a cybersecurity tool identified a zero-day vulnerability in an industry product and alerted the vendor.
The company issued a patch several weeks later. A subsequent scan, however, indicated that the update was either invalid or insufficiently effective. Officials had to return to the vendor, and the vulnerability was only corrected after further action.
The episode shows that releasing a patch quickly is not enough. The update must be tested, properly installed and subsequently verified to ensure that the vulnerability has actually been eliminated.
The war in Ukraine turned patching into a readiness issue
For US Strategic Command, software updates must be treated as a basic requirement of operational readiness.
At the beginning of the war in Ukraine, officials had to determine whether systems could safely be interrupted for updates. The initial idea of temporarily halting patching proved impossible to sustain.
The eventual solution was to establish a dedicated team responsible for reviewing every authorized service interruption and determining whether it could occur without affecting critical missions.
Software updates are the digital equivalent of weapons maintenance
The patching process has been compared to the physical maintenance of military equipment. A weapon system, aircraft or submarine cannot be considered reliable if it is not regularly maintained.
The same principle applies to information technology infrastructure. A system that is left unpatched gradually loses its reliability and can become a direct vulnerability for the entire mission.
The culture of continuous availability is colliding with cyber reality
James Grimsley, deputy chief information officer and executive director for command, control, communications and cyber systems at US Transportation Command, pointed to a long-standing cultural problem.
For years, certain operational systems have been considered so important that they must remain continuously available and cannot be taken offline for patching. The accelerating cyber threat environment is making that approach increasingly difficult to defend.
Under current conditions, a temporary and carefully controlled outage may be less dangerous than leaving a known and exploitable vulnerability exposed.
For defense networks, patching is no longer a routine technical task. It has become a matter of resilience, risk management and military readiness.
