NCSC urges organisations to prepare for ‘vulnerability patch wave’

The UK’s National Cyber Security Centre (NCSC) has warned organisations to prepare for an imminent “vulnerability patch wave” due to AI accelerating the discovery and exploitation of long-standing software weaknesses.

In new guidance, the cyber authority said decades of accumulated technical debt across software systems could trigger a surge in security updates, forcing organisations to rapidly patch vulnerabilities across their technology stacks.

Technical debt, which is often the result of prioritising short-term development over long-term resilience, exists across open source, commercial and proprietary systems, as well as software-as-a-service platforms. The NCSC said advances in AI now allow attackers to identify and exploit these weaknesses at scale, increasing the need to make them safe.

The organisation expects a “forced correction” across the industry, with a sharp rise in disclosed vulnerabilities leading to a wave of patches that businesses must deploy quickly and at scale.

To mitigate risk, the NCSC urged organisations to prioritise their external attack surfaces, including internet-facing systems, cloud environments and on-premises infrastructure. By securing these entry points first, it said, firms can reduce exposure to newly discovered vulnerabilities.

Where resources are limited, the NCSC recommends focusing patching efforts on perimeter systems and critical security infrastructure. However, it noted that patching alone will not be sufficient in all cases, particularly where legacy or end-of-life systems cannot receive updates, requiring replacement or additional safeguards.

The guidance calls on organisations to adopt an “update by default” approach, enabling automatic updates and hot patching where possible to minimise disruption. Businesses should also prepare for more frequent and large-scale updates, including across supply chains, as vulnerabilities emerge.

In cases where critical vulnerabilities are actively exploited, the NCSC said organisations must accelerate patching processes and respond immediately to reduce risk.

Beyond patch management, the NCSC emphasised the need to address underlying structural issues, including improving memory safety and strengthening system resilience. It also highlighted the importance of adopting baseline security frameworks such as Cyber Essentials to improve overall cyber hygiene.