The Patch Gap: Why Distributed Enterprises Need Protection Before the Fix Arrives

When a vendor releases a security patch, two clocks start. The first is the attacker's clock, and it now runs in a day or less. The second is the compliance clock: PCI DSS gives organizations up to one month to install fixes for critical vulnerabilities.

For years, security teams had a buffer. A vulnerability was disclosed, a patch followed, and attackers needed time to turn the flaw into a working exploit. That buffer is gone.

In Patchmageddon, J.P. Morgan's July 2026 Eye on the Market report, Michael Cembalest and Global CISO Pat Opet lay out how frontier Artificial Intelligence (AI) models have changed the math. Today, many vulnerabilities are exploited on or before the day they're disclosed. A record 48,185 vulnerabilities were published in 2025, more than 130 a day.

Meanwhile, the time organizations need to remediate keeps rising. Verizon's 2026 Data Breach Investigations Report (DBIR) puts the median time to fully remediate vulnerabilities already known to be exploited at 43 days, up from 32 days a year earlier.  

J.P. Morgan concludes that patching is now the bottleneck. AI has made finding flaws cheap and fast. Fixing them is as slow and careful as it's always been.

For CIOs, CISOs, and IT leaders at distributed enterprises (multi-location retailers, restaurant and hospitality groups, franchise systems, healthcare networks, and branch-based financial services), that bottleneck is tighter still. In our work protecting more than 4 million business locations, we see the same pattern again and again. The patch exists. It just hasn't reached every location yet.

Why patching is harder across hundreds of locations.

Patching a single data center is hard enough. Every fix means new code in production, testing to make sure nothing else breaks, and a change window that doesn't disrupt the business. As Opet puts it on the report's companion podcast, the industry has spent years building tools to find vulnerabilities and very little to fix them.

Distributed enterprises face four added complications:

• Lean IT at the location level. In our experience, many locations have no on-site IT staff. Nobody at a busy store or restaurant will test and deploy a firmware update in the middle of a shift.
• Devices that sit at the edge. Firewalls, routers, remote access appliances, and point-of-sale (POS) systems live at every location. According to Opet, perimeter devices have been the main way attackers gained initial access over the past 12 months. A brand with 800 locations has 800 network edges to keep current.
• Software you don’t control. When a POS vendor or SaaS provider ships a fix, the timing is theirs. The average commercial application now contains almost 1,200 open source components, according to data cited in the J.P. Morgan report, and the vendor is responsible for patching every one.
• Hardware past its prime. Location equipment often stays in service longer than vendors recommend. As vendors focus their fixes on current releases, end-of-life devices may never get a patch.

The result is predictable. TuxCare's 2026 research ties 61% of reported incidents to patches that were available but not applied. And in a September 2026 Chainguard survey of 1,300 security leaders, 66% of those at companies with $1 billion or more in revenue said they knowingly leave high- or critical-severity vulnerabilities unpatched at least sometimes. Operational disruption was the most cited reason. When downtime means a register that can’t take payments, that tradeoff feels even sharper.

VikingCloud’s 2026 restaurant research shows the same pattern at the location level: 78% of restaurant leaders said they had delayed a security patch or update to avoid disrupting operations.

Limited visibility makes it worse. In VikingCloud’s 2026 Cyber Threat Landscape Report, 48% of distributed enterprises said they lack real-time visibility across all their locations, and 40% said they’d likely miss an active threat at their least-monitored sites. You can’t confirm a fix reached every location if you can’t see every location.

Security leaders can see this coming. Ninety-seven percent have discussed frontier model threats, and 60% are very or extremely concerned that AI-accelerated attacks will target their organization in the next 12 months. The response hasn’t kept pace. Only 40% have centralized patch management that can push a fix to every location at once, and just 34% have deployed 24x7 centralized threat monitoring across all locations. For most brands, the window between disclosure and fix is still wide open.

The compliance clock and the attacker clock no longer match.

That one-month window comes from PCI DSS v4.0.1 Requirement 6.3.3. For a team rolling changes out across hundreds of sites, it’s a reasonable standard, but it was set when attackers needed weeks to weaponize a flaw.

That’s no longer the case. Even the patch itself now works against defenders: the J.P. Morgan report notes that AI can turn a newly released patch into a working exploit within minutes.

Many organizations miss the one-month mark anyway. Verizon’s 43-day median is already past it, and only 26% of known-exploited vulnerabilities were fully remediated at all, down from 38% a year earlier. And the ones that make it aren’t necessarily safe. A business can install a critical patch on day 29, stay fully compliant, and still have been exposed for 29 days. We’re not suggesting anyone abandon PCI deadlines. The point is that compliance sets the deadline. It doesn’t protect you while you work toward it. Every security leader should be asking what’s protecting each location between the day a patch is released and the day it’s installed. And for a zero-day, there’s no patch to wait for at all.

What protects you before the patch arrives?

Patching will always take time. What matters is what’s protecting each location while it does. The J.P. Morgan report points in the same direction. It urges organizations to lean harder on the critical controls set out by the National Institute of Standards and Technology (NIST) and the U.K.’s National Cyber Security Centre, such as hardened network configurations, Multi-Factor Authentication (MFA), and comprehensive logging. Those controls improve security without depending on any single patch arriving in time.

For distributed enterprises, that comes down to three things every day:

• 24x7 monitoring and detection. Centralized logging, real-time alerting, and a security operations team watching every location, even when it’s closed, so attempts to exploit a known vulnerability get caught while the patch is still in the queue.
• Protection at the edge. Next-generation firewalls and intrusion detection and prevention (IDS/IPS) at each location, configured to one centrally managed standard rather than location by location.
• Knowing where you’re exposed. Vulnerability scanning and an up-to-date software inventory show which locations run the affected devices and versions when a new vulnerability lands, so patching effort goes where it matters first. Penetration testing shows what an attacker could actually reach.

When a zero-day hits.

A zero-day leaves nothing to install. The job shifts from patching to shrinking what an attacker can reach until the software or hardware manufacturer ships a fix. That means acting on several fronts at once:

• Isolate affected devices. Cut vulnerable systems off from the rest of the network, so one exposed device at one location doesn’t become a path into the whole business.
• Tighten firewall rules. Stricter ingress and egress rules, pushed to every location, block the traffic an exploit depends on and limit what a compromised device can reach.
• Lock down endpoints until the fix arrives. Managed Detection & Response (MDR) can restrict local machines at affected locations until a patch is released.

The hard part for a distributed enterprise isn’t knowing these steps. It’s carrying them out across hundreds of locations in minutes, from one place, without waiting on anyone at the store level.

Patching on a schedule that fits the business.

Not every update needs to go out the moment it’s released. Many brands depend on legacy software built around a specific version of code, and a minor, unrelated update can break it. Some deliberately stay one version behind to protect uptime.

That’s a reasonable choice, as long as it’s a managed one. Centralized version control lets security teams release critical fixes on schedule while staging or holding other updates that would collide with operations. It’s the difference between a deliberate decision and a location that quietly fell behind, and it’s how brands resolve the tradeoff between patching and keeping the registers running.

None of these controls replace governance. As Kevin Pierce, President and COO at VikingCloud, puts it: “You cannot monitor your way out of blast radius. You have to govern.” Compensating controls buy you time. Strong patch discipline and governance shrink exposure for good.

Get exceptionally good at the basics.

One of the most practical findings in the J.P. Morgan report is also the simplest. When the firm moved to the most current versions of open source across its dependencies, half of its high and critical issues went away. Opet’s broader advice is that doing the basics is no longer enough. Organizations need to be exceptional at them.

For distributed enterprises, we’d start here:

1. Know every device at every location, including its software version and support status.
2. Shorten your change process so critical fixes reach locations in days, not weeks.
3. Have a zero-day plan before you need one. Decide in advance who can isolate devices, tighten firewall rules, and lock down endpoints, and how fast that reaches every location.
4. Track time to patch by location. A fleet-wide average can hide the handful of sites that lag by weeks.
5. Replace end-of-life edge devices before a vulnerability forces the decision.
6. Hold vendors to clear patching commitments, and ask how they track their open-source dependencies.
7. Cover the gap between disclosure and fix with 24x7 monitoring and response.

The same discipline needs to extend to AI itself. Locations are adopting AI chatbots, scheduling tools, and AI features built into vendor platforms, yet our research found only 4% of large multi-location brands require a corporate security review before a location adopts one. Every unreviewed tool is one more thing to patch, monitor, and govern.

AI will keep finding vulnerabilities faster than any team can fix them. Businesses that do this well will be the ones that can protect every location in the time between disclosure and fix.

How VikingCloud can help.

VikingCloud Managed Security Services (MSS) brings these capabilities together for distributed enterprises: 24x7 monitoring through our Security Operations Center (SOC), managed firewalls and IDS/IPS, MDR with an average time to containment of less than 30 minutes, and Vulnerability Scanning and Penetration Testing through the Asgard Platform®. When a zero-day hits, we can isolate devices, push stricter firewall rules, and lock down endpoints across every location from one place. And because we maintain version control over what’s released to each location, critical security updates go out on schedule while other changes are timed around how your business runs.

We manage more than 82,000 locations and have installed more than 350,000 network and security devices. As AI tools spread across your locations, our AI Governance Services help you identify what’s in use and close the gaps.

Contact us to learn more about Managed Security Services.