Why Your Patch Window Just Got Shorter (And What SOC 2 Evidence Actually Proves)

Two stories broke this week that should be required reading for anyone who thinks “we patch when we get to it” is a strategy.

The two-month gap that got exploited

CISA just added CVE-2026-45659, a remote code execution flaw in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog. Microsoft patched this back in May 2026. Federal agencies had until July 4 to apply the fix — and it’s already being actively exploited in the wild.

That’s a two-month window between “patch available” and “mandatory deadline,” and attackers didn’t wait around being polite about it. This is a familiar pattern for anyone who’s worked vulnerability management: the patch exists, the advisory goes out, and somewhere between “we should get to that” and “we got to that” is exactly where the breach happens.

The story that should really get your attention

Researchers recently documented what they’re calling the first ransomware operation run entirely by an LLM agent — not a human using AI to draft a phishing email, but an autonomous agent that planned and executed the attack itself, no hands on keyboard during the operation.

Here’s why I’m putting these two stories together. For twenty-plus years, the security conversation has been “patch faster than the humans trying to exploit you.” That math just changed. When the attacker side has an autonomous agent that never sleeps, never gets bored halfway through recon, and doesn’t need a paycheck, a two-month patch window isn’t a manageable delay anymore — it’s an open door with a welcome mat out front.

Why this changes the compliance conversation, not just the technical one

If you’re a small or mid-size organization still running vulnerability reviews on a quarterly cycle, you’re defending against a threat model that stopped existing sometime in the last 18 months.

This is exactly why SOC 2 readiness isn’t a compliance checkbox to clear once and forget. Done right, it’s the operational discipline of actually knowing what’s exposed, patching on a real cadence, and having documented evidence that you did it — not a policy binder that says you should have.

Auditors ask for that evidence for a reason. Increasingly, so do insurers and customers, and the question underneath all of it is the same one: can you prove you weren’t the easy target?

The gap between “we have a patch policy” and “we can demonstrate our patch policy actually runs, every cycle, with evidence” is where most breaches live. Closing that gap is the whole game now — before something faster than your process finds it first.

Patch like the attacker doesn’t need coffee breaks anymore. Because it doesn’t.

---