Windows has adapted to emerging threats for decades, all while operating at unparalleled scale. It’s our responsibility to bring clarity, transparency and sustained investment so customers understand what is happening, what Microsoft is doing and how they can reduce their exposure.
The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis. The fastest way to reduce customer exposure is to find issues before attackers can use them. Windows is expanding its ability across the platform to find issues earlier, accelerate the engineering work to fix them, strengthen validation and deliver timely, high-quality updates that keep customers protected.
Finding vulnerabilities earlier and at greater scale #
By applying AI across security analysis, we can identify patterns faster, prioritize risk and scale vulnerability discovery across the Windows codebase. This helps reduce the time between discovery and customer protection. It includes using Microsoft Security’s multi-model agentic scanning harness (MDASH), which utilizes multiple models including leading third-party AI vulnerability discovery models.
To run MDASH at Windows scale, Windows set up dedicated cloud infrastructure for scanning and proving. A scanner pipeline scans critical binaries and validates candidates using multi-model debate across multiple model families. Confirmed candidates then flow to a separate, Windows-specific prove pipeline that helps eliminate remaining false positives, so only the highest-confidence findings reach the engineering team. This automation helps handle a larger volume of potential vulnerabilities and shortens the review window for new ones, shrinking the attack window for zero-day exploits.
This effort extends beyond Windows as we work across Microsoft to drive broader adoption of these tools and practices throughout both the company and the wider ecosystem. We partner closely with AI-powered scanning teams across Microsoft’s product divisions, sharing insights, comparing best practices and aligning on key findings. In parallel, we collaborate with the Microsoft Security Response Center (MSRC) to continuously refine the end-to-end process from vulnerability discovery and issue filing to remediation and validation. We also regularly reassess our prioritization and rollout strategy based on lessons learned and feedback gathered through our Chief Information Security Officers’ (CISOs) engagements with customers.
We continue to evolve our internal systems and practices so that vulnerability discovery is not treated as a separate activity, but as part of how we build, review and improve Windows before new features or updates are released. As a part of this we are updating our Secure Development Lifecycle (SDL) best practices to ensure our secure-by-design approach explicitly accounts for potential AI-enabled attack techniques and exploit paths.
That means using AI to help identify potential issues earlier in the development process, while relying on human expertise to evaluate findings, make risk-based decisions and ensure fixes meet the quality bar customers expect.
As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release. This is evidence that defenders are getting better at identifying and addressing issues. Our focus is to effectively utilize these AI tools to support faster protection, stronger engineering systems and more actionable guidance for customers.
Fixing responsibly with AI and engineering discipline #
Windows is evolving our engineering and validation systems to reduce the time from discovery to protection, with areas where customer risk is greatest. As we build our end-to-end system from discovery to remediation of vulnerabilities on Windows, we’re making the following investments to help ensure that we are not compromising update quality as we gain speed:
- We are integrating AI into our process to compress the path from discovery to a validated fix, helping engineers understand failures faster, propose candidate fixes consistent with the surrounding code, surface related issues elsewhere in the codebase and select the regression tests most likely to be affected by a change.
- Windows updates undergo validation across a range of testing environments, including the Security Update Validation Program (SUVP)and internal validation designed to help evaluate compatibility, reliability and real-world usage scenarios. This broad validation helps identify , application compatibility and quality issues before updates are broadly released. - We’re also investing in new technology, including Windows-specific tools and agentic harnesses, to enable end-to-end generation and validation of fixes using AI, keeping humans in the loop when it comes to code review.
Customers rely on Windows updates to protect their environments, and they also need confidence that updates will deploy smoothly across diverse devices, applications and configurations. That is why quality remains central to this work. As we increase the pace of vulnerability discovery and remediation, we are also committed to giving customers practical ways to test, deploy and monitor updates in their own environments. In cases where customers see signals of potential issues or regressions, they can connect with to report the issue and/or learn if it is a known issue. In the event of an issue, we are able to employ Known Issue Rollback (KIR), a mitigation technology that allows customers to quickly revert a targeted change, fix, functionality or feature that caused the problem, to its previous behavior. This approach allows the customer’s security protections to stay in place instead of uninstalling an entire update to fix an issue.
Helping customers safely stay current #
The most important guidance is to stay current and take security updates as soon as possible. Timely patching is one of the most effective ways to reduce exposure, especially as AI accelerates the speed at which vulnerabilities can be discovered and exploited.
We also recognize that every customer’s situation is different. Many organizations need to assess risk, validate updates, sequence deployments and prioritize critical assets. When Microsoft releases security updates, we share Common Vulnerabilities and Exposure (CVE) information and high-level guidance about the vulnerabilities addressed in the Security Update Guide, including available context on risk and mitigations where applicable. Customers should use that information to build a risk map for their own estate, prioritize protections for high-value targets and accelerate deployment where exposure is greatest.
To help organizations prepare with less disruption, we also provide ahead of the planned security update release for the following month for testing. These cumulative releases include new features and quality improvements. We target optional non-security preview releases for the fourth week of the month, two weeks before they’ll see these features become part of the next monthly security update. These previews enable compatibility testing across a broad set of devices, applications and environments, helping identify issues earlier and increasing confidence in the quality and deployment readiness of the subsequent monthly security updates.
Security is not just about responding faster to vulnerabilities. It is also about reducing exposure to security attacks. Windows is designed with multiple layers of protection enabled by default, strong identity protection with Windows Hello, the ability to reduce reliance on administrator privileges, trusted application experiences and hardware-rooted security. Together, these capabilities help organizations reduce exposure, strengthen resilience and provide a more secure foundation as organizations assess, test and deploy updates across their environment. To learn more about Windows security, see the Windows 11 Security Book or the Windows Server 2025 Security Book for your Server fleet.
Windows also works closely with Microsoft Defender and the broader security ecosystem to help protect customers during the window between vulnerability disclosure and full deployment of security updates. Where possible, Microsoft Defender provides detections and protections that add another layer of defense. Through programs such as Microsoft Active Protections Program (MAPP), Microsoft also collaborates with security protection and antivirus partners so they can prepare protections for customers as security updates are released. We recommend that customers update their security endpoint software to the latest version and take daily signature updates for best protection. Intune helps teams identify gaps, enforce compliance and deploy fixes across endpoints, and Azure Arc makes it easy to connect Windows Servers outside Azure to Microsoft Defender for Cloud.
Tools that make patching easier #
A holistic patch strategy depends on tools that help teams move across the full lifecycle: automate what can move fast, identify what still needs attention and limit exposure when devices or apps fall behind. Modern management capabilities such as Windows Autopatch with hotpatch enabled, available in Microsoft Intune, can help accelerate security updates and minimize disruptions for your Windows 11 devices. With Autopatch, customers can configure the automatic deployment of Windows security updates, driver updates and firmware updates, based on reliability signals, so issues can be contained before they spread.
Autopatch now surfaces a with device-level drill-down, so customers can see where their estate is exposed and how to reconfigure their policies to stay more secure.
Windows Servers can be hotpatched as well through Azure Arc, enabling rebootless security updates for your critical infrastructure and VMs across the fleet, manageable at scale with Azure Update Manager.
Intune Enterprise Application Management helps keep apps current. Microsoft Defender Vulnerability Management, Windows and Intune insights help teams understand remaining exposure and prioritize remediation. Compliance policies, Conditional Access and security baselines help enforce the desired state across the endpoint estate, or harden devices when updates can’t be applied right away. Together, these capabilities help customers move from a time-based patching cadence to a more continuous, risk-based approach.
For practical guidance on operationalizing patching across endpoint estates, see the Microsoft Intune blog on building a patch strategy for today’s threat pace.
Building trust through continuous improvement #
The threat environment will continue to evolve as AI advances, with researchers continuing to find new classes of issues and attackers looking for ways to move faster. Our response is to keep strengthening the systems that help us find vulnerabilities earlier, fix them responsibly and support customers through safe, timely updates.
As the pace of vulnerability discovery increases, customers shouldn’t have to choose between speed and stability. Our job is to help customers stay protected while deploying updates with confidence. Windows will continue investing in the systems, engineering practices and platform protections needed to reduce exposure responsibly at global scale.