Nine in 10 Australian firms hit by slow patching risks

Nine in 10 Australian organisations have faced a security incident, suspected incident or near miss linked to slow patching, according to research from Azul based on a survey of 200 Australian cybersecurity leaders.

The study highlights a gap between how quickly attackers using AI can exploit software vulnerabilities and how long many organisations need to test and deploy critical updates in production systems.

More than half of respondents, 57%, said their organisation had suffered a confirmed incident attributable to slow patching. The broader 90% figure includes suspected incidents and near misses, suggesting patching delays are now a routine security problem rather than a marginal risk.

Timing is a central issue. Some 51% of Australian security leaders said they believe AI-equipped attackers can develop a working exploit within one to three days of a critical vulnerability becoming public, while 7% said this could happen in less than 24 hours.

By contrast, 45% said their organisation usually needs four to six days to deploy a critical security patch across production. Another 15% said the process can take up to a week.

Testing appears to be a major source of delay. Among those surveyed, 42% said pre-deployment testing adds four to six days to the Java patching cycle, while 30% said it adds one to three weeks.

The data suggests many organisations remain exposed after vulnerabilities are disclosed, even before patch deployment begins in earnest. It also indicates that security teams are trying to balance speed against concerns that updates could disrupt production systems.

Java focus

The research centres on organisations with significant Java estates, which can be difficult for security teams to fully track across large, complex environments. Java often sits behind core business applications, and patching can involve both security fixes and broader code changes, making testing more burdensome.

The findings came soon after an OpenJDK quarterly update disclosed 53 vulnerabilities, which Azul described as the highest number in a single update in more than a decade. That has sharpened attention on whether existing patching processes are still suited to a faster attack cycle.

The survey also found inconsistency in how organisations handle lower-priority flaws. Only 33% of Australian respondents said their organisation requires non-critical vulnerabilities to be patched within a defined timeframe.

Another 32% said such vulnerabilities are patched on a best-effort basis, while 14% said their organisation has no formal patching policy. That suggests many businesses still lack structured deadlines once an issue falls outside the most severe category.

More broadly, patch management remains constrained as much by internal processes as by outside threats. In large organisations, production updates often require multiple rounds of testing, operational sign-off and coordination across application teams, stretching response times even for urgent fixes.

That leaves security leaders confronting a problem of execution rather than awareness. Many already accept that AI has compressed the time available to respond, but the survey suggests internal patch cycles have not kept pace.

Azul also released global findings from a separate survey of 300 US security leaders that pointed in a similar direction. In that research, 85% of organisations reported an incident, suspected incident or near miss due to slow patching, and 69% said attackers using AI could build an exploit in three days or less.

The US data found that only 13% of organisations could deploy a critical patch across production in under 24 hours, while 32% needed four to six days and 12% took longer. It also found that testing alone added four or more days for most respondents.

While the Australian and US samples are separate, both sets of results point to the same structural issue: attack timelines are shortening while patch deployment remains tied to slower operational processes.

Scott Sellers, co-founder and chief executive officer of Azul, said the issue is no longer whether security leaders understand the threat. "Agentic AI has collapsed the margin defenders depend on, and most enterprises are still running patch processes built for a much slower adversary," Sellers said.

"Our research shows security leaders understand the threat: awareness is no longer the gap; execution is. No one can eliminate zero-day risk, but every organisation decides how long it stays exposed by how much of its Java estate it can see and how fast a fix can move through it. Azul's Security-only, Stability-first(tm) updates include only security patches, with nothing else bundled in that could risk breaking things, so enterprises can move fast and close that exploitation window before an attacker finds it first," he said.