Patching Costs for high-severity software flaws now include far more than the price of a vendor update. The larger expense is labor, testing, deployment control, verification, and the business coordination needed to avoid outages. That pattern was visible on October 14, 2026, when Bank of America said it had hired about 1,000 external contractors, alongside an existing staff of about 3,000, after vulnerabilities were surfaced by Anthropic’s Mythos model released in April 2026. The bank described remediation costs as “a couple hundred million plus,” with only a portion tied to AI-related findings, according to what Quartz reported.
Why Patching Costs Rose in 2026
The financial burden increased because vulnerability volume, dependency exposure, and operational caution moved in the same direction. The supplied research cites a mid-2026 forecast of about 66,000 distinct CVE disclosures for the full year, which expanded the workload for triage, patch development, rollout planning, and evidence collection. A higher count of disclosed flaws does not mean every organization must patch every item immediately, but it does increase the number of decisions security teams must document.
Patching Costs Start With Labor
Patch deployment depends on people who can classify exposure, test fixes, coordinate maintenance windows, and confirm that remediated systems stayed remediated. A July 2026 analysis by Patchly estimated that a minimal in-house patch program without a dedicated vulnerability management layer cost about $18 to $24 per endpoint per month. A more developed remediation function with visibility, deployment, verification, and evidence cost about $27 to $31 per endpoint per month; at 1,000 endpoints, the annual estimate was about $255,000 to $359,000, according to Patchly’s analysis.
Those figures help explain why headline remediation events can grow quickly. At enterprise scale, even small per-endpoint changes compound across laptops, servers, virtual machines, containers, and specialized software stacks. A patch program also needs records showing what was found, what was fixed, what failed, and why some systems were deferred. That evidence burden is not optional in many regulated environments, even when a patch is technically simple.
What Automation Does and Does Not Remove
Automation can reduce repeated tasks, such as inventory checks and deployment status reporting. It does not remove the need for exception handling, compatibility testing, rollback planning, or business-owner approval. A related analysis of AI-driven patching controls makes the same point: software can assist prioritization and workflow, but validation and governance still define whether remediation is safe enough for production.
Staffing, Tooling, and Verification
High-severity remediation has three cost centers that are often mixed together in budget discussions: staff time, tool subscriptions, and verification. Staff time covers vulnerability analysts, endpoint administrators, application owners, change managers, and help desk teams. Tooling covers endpoint management, vulnerability scanning, deployment orchestration, endpoint detection, identity controls, and reporting systems. Verification covers rescans, deployment evidence, exception review, and documentation for audit or customer assurance.
The research notes show why these categories should be separated. A patching program may buy tools but still lack enough staff to test and confirm fixes. The opposite can also happen: skilled engineers may have to work from incomplete asset inventories or disconnected deployment systems, which increases manual follow-up. In both cases, the operational cost appears later as extended remediation time, unpatched assets, or failed deployments that trigger support tickets.
| Cost Area | What It Covers | Operational Trade-Off |
|---|---|---|
| Labor | Triage, testing, deployment, rollback planning, documentation | Higher staffing can shorten queues, but expert labor is expensive |
| Tooling | Scanning, endpoint management, deployment, evidence, detection | Better visibility can reduce manual work, but tools need integration |
| Change Control | Maintenance windows, approvals, outage avoidance | Safer rollout can slow remediation for exposed systems |
| Verification | Rescans, status evidence, exception handling | Proof of completion consumes time but reduces false confidence |
The table shows why Patching Costs cannot be judged from software licensing alone. A free vendor patch can still require expensive internal handling if the affected platform supports business-critical workloads, legacy dependencies, or vendor-controlled infrastructure.
How Patching Costs Become Operational Drag
Patching Costs also rise when a fix might break the system it is meant to protect. The supplied MITRE FAST Study findings highlight that some operational technology, legacy, and vendor-controlled environments cannot always accept a patch safely or quickly. In those cases, organizations may rely on compensating controls, formal plans of action and milestones, and coordination with vendors. Those steps reduce risk in a different way, but they add documentation and monitoring work.
Known Exploited Vulnerabilities Create Time Pressure
The research also reports that only 26% of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were fully remediated by organizations in 2025, down from 38% in 2024, while median full resolution time rose to 43 days. That matters because KEV items are not theoretical defects; they are flaws with evidence of exploitation. A longer resolution period means security teams must spend more time on temporary controls, exposure review, and executive risk acceptance.
Survey data in the research shows a similar pattern. Among more than 900 cybersecurity leaders, organizations that patched within 24 hours still reported a 77% rate of incidents involving known vulnerabilities, while organizations patching in four to seven days reported 97%. The finding does not prove that speed alone prevents incidents, because exposed assets, sector, staffing, and detection quality can differ. It does support a cautious interpretation: delay is costly because it extends the period in which known flaws remain usable by attackers.
Dependency Exposure Adds Hidden Work
Modern software also depends on third-party libraries and services. The supplied research reports that 87% of organizations had at least one known exploitable vulnerability in deployed services, and more than 42% of services relied on libraries that were no longer actively maintained. That creates hidden labor because teams must identify where the vulnerable component is used, whether an upgrade exists, and whether the new version changes application behavior. Fast adoption can help, but the same research notes that half of organizations adopt new library versions within 24 hours, which can introduce risk if changes are not vetted.
Patching Costs Across Software Platforms
The evidence supports a restrained conclusion: Patching Costs vary by asset count, platform type, staffing model, tooling maturity, and tolerance for downtime. Finance, healthcare, government, utilities, cloud services, endpoint fleets, and operational technology systems do not face the same constraints. The supplied research reports wide differences in remediation workloads and time to remediation across sectors, including heavier monthly remediation volumes in financial services and longer critical-exposure remediation times in healthcare than in utilities.
For security leaders, the practical task is to budget for the full remediation chain rather than only patch deployment. That means funding asset visibility, prioritization, testing, staged rollout, rollback, verification, and exception governance. Readers tracking adjacent infrastructure and security topics can also review related technical coverage from the same network.
The limits of the evidence are clear. The cited cost estimates are not universal price quotes, and the Bank of America example was an unusually large enterprise event with only part of the spend tied to AI-related vulnerability discovery. The supplied research does not quantify energy use from patching operations, so no energy-cost claim can be made here. The safest reading is that high-severity remediation is a recurring operating expense whose scale depends on environment size, software age, regulatory burden, and how much proof an organization must produce after the fix.