SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Socura's poll of 500 UK security leaders finds 22% have tried to avoid Patch Tuesday
Socura's survey of 500 UK security leaders found 22% said they have tried to avoid Patch Tuesday by calling in sick or booking holiday. Socura blames rising patch volume, but the figures reported cover hours and stress, and staff turnover is not among them.
The Watch · Security desk
Two values. The previous Patch Tuesday record was 570 CVEs fixed, set two months before the September 2026 release. Microsoft's September 2026 Patch Tuesday fixed a record 974 CVEs.
| Measure | Value | As of | Claim |
|---|---|---|---|
| Previous Patch Tuesday record | 570 CVEs fixed | 2 months before | 6 |
| Microsoft, September 2026 | 974 CVEs fixed | September 2026 | 5 |
What happened
- Beyond the avoidance figure, 41% said they have worked overtime to manage the patching cycle and 37% said they have worked late to deploy patches.
- 29% said they feel significant anxiety the night before Patch Tuesday, and the same share said they grow more irritable with colleagues or family that week.
- Microsoft's September 2026 Patch Tuesday patched 974 CVEs, a record. The previous high of 570 was set two months earlier.
Why it matters
- decision Patch Tuesday recurs monthly on a known date, so a team can name a deputy and a rota for it a month ahead.
- cost Leave moves the work to the return date: 43% of leaders in Seemplicity's report said time off brings a huge amount of stress when they get back.
- precedent Infosecurity ties the rising workload to AI-powered research that helps vendors find more flaws, so we'd expect the 974 record to be beaten.
Socura blames the growing number of patches and rising stress levels [19]. The one volume figure in the write-up is Microsoft's September release, about 71% above the record it replaced [15]. Infosecurity sets that against 1130 vulnerabilities published in all of 2025 [21], but the scope of that number is unclear, so we leave the comparison aside.
In our view, a CVE count measures the size of the queue. How fast any single patch must go out depends on whether attackers are using the flaw.
The timing limits the causal claim. Seemplicity's report was published in March 2026, four months before the July record [18]. Leaders were already reporting extra weekly hours before that release.
Respondents also saw upside in AI. Two-fifths (40%) told Socura it automates mundane work and frees teams for strategic tasks [9], and 37% said it helps protect core infrastructure against active threats [10].
Socura is an MDR specialist [13]. With a sample of 500, the 22% is about 110 respondents [16] and the 29% is about 145 [17]. Andrew Kays, Socura's CEO, reads the avoidance as burnout. "It speaks volumes about the unhealthy levels of stress and burnout in our industry that cybersecurity leaders would deliberately avoid the office during their most consequential day of work," he said [11].
His remedy is staffing. "It's vital that security teams are properly resourced on Patch Tuesday, and that cybersecurity workers are properly supported emotionally, technically, and financially," Kays said [12].
What to watch
- Microsoft's next Patch Tuesday count against the 974 record.
- Any survey that asks patching teams about resignations or vacancy rates, which would test the retention claim.
- Whether Socura publishes its sampling method and fieldwork dates.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+25
- Incentives70
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Socura, an MDR specialist, polled 500 UK CSOs, CISOs and heads of IT security about their attitudes to AI and to Patch Tuesday.
- [2]
22% of respondents said they have tried to avoid Patch Tuesday altogether; Infosecurity reports one in five has either called in sick or deliberately booked holiday to avoid it.
- [3]
41% of respondents said they have worked overtime to manage the patching cycle, and 37% said they have worked late to deploy patches.
- [4]
29% of respondents said they feel 'significant anxiety' the night before Patch Tuesday, and the same share said they become more irritable with colleagues or family during that week.
- [5]
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday release.
- [6]
The previous record of 570 CVEs fixed in a Patch Tuesday release was set two months before the September 2026 release.
- [7]
A Seemplicity report published in March 2026 found that 45% of cybersecurity leaders work 11 or more extra hours per week, and 20% work 16 or more extra hours weekly.
- [8]
The Seemplicity report also found 43% of respondents said they are unable to take time off without creating a huge amount of stress upon their return.
- [9]
40% of respondents told Socura that AI automates mundane work, which frees teams to focus on more strategic tasks.
- [10]
37% of respondents claimed AI is helping them better protect core corporate infrastructure against active threats.
- [11]
"It speaks volumes about the unhealthy levels of stress and burnout in our industry that cybersecurity leaders would deliberately avoid the office during their most consequential day of work," said Socura CEO Andrew Kays.
- [12]
"It's vital that security teams are properly resourced on Patch Tuesday, and that cybersecurity workers are properly supported emotionally, technically, and financially," said Kays.
- [13]
Socura describes itself as an MDR specialist; the source calls it 'the MDR specialist' that ran the poll.
- [14]
Patch Tuesday is the once-a-month date on which Microsoft, Adobe and other vendors release their latest security updates.
- [15]
Microsoft's September 2026 release of 974 CVEs was about 71% above the previous record of 570.
- [16]
22% of the 500 respondents is about 110 people.
- [17]
29% of the 500 respondents is about 145 people.
- [18]
The Seemplicity report, published in March 2026, came about four months before the July 2026 record of 570 CVEs.
- [19]
Socura laid the blame on a growing number of patches and rising stress levels.
- [20]
The patching workload is rising as AI-powered vulnerability research helps vendors discover software flaws in greater volumes.
- [21]
Infosecurity states that just 1130 vulnerabilities were published in the whole of 2025, without specifying whose vulnerabilities the figure covers.
Sources
1 independent publisher whose own reporting we read for this story.
- infosecurity-magazine.comFifth of CISOs Take Time Off to Avoid Patch Tuesday
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Security team burnoutFollow
- AI in cybersecurityFollow
- Patch TuesdayFollow
- Vulnerability ManagementFollow