I Was Ready to Patch Without My Client’s Approval. I’d Do It Again.

The call I’d make again

Recently, a zero-day was being actively exploited against a type of equipment one of our clients runs. Every security professional I talked to that day said the same thing: this one was live, and it was widespread. We reached out to the client for approval to patch. I told my team that due to the active exploits and lack of mitigating controls, if we didn’t hear back within two hours, I’d approve the patch myself.

The client got back to us in time. I was still prepared to take the heat for an unapproved change, and I’d make the same call again. I’d rather answer for that than for leaving a known door open while we waited for a callback.

Here’s why I set a two-hour clock. McKinsey cites industry tracking data showing that the average time from disclosure to active exploitation of a critical vulnerability fell from about 23 days in 2025 to an estimated 20 hours this year. When approval might take a day, waiting for it can mean delaying action past the point of exploitation.

It was the first time in my career I’d made that call. The decision itself wasn’t hard. What stayed with me was that our governance model wasn’t built for it.

The lesson is that our clients and our teams need to agree, before an emergency, on when immediate action is warranted. That means defining the threats that trigger emergency procedures, who has authority to act, what actions are permitted, which systems require additional safeguards, and how decisions will be communicated and documented. When those boundaries are established in advance, speed and governance reinforce each other rather than compete.

AI-powered cyberattacks are changing the threat landscape

That zero-day was one of several things that hit in a short span.

The phishing we’re reviewing is the best I’ve ever seen. The grammar is clean, the branding is right, and the context is believable. I do this for a living, and some of these emails would have fooled me. And when one succeeds, we’re seeing lateral movement in record time.

We’re also watching users get mail bombed, meaning their inboxes are flooded with thousands of junk sign-ups. Then they receive an inbound Teams call from someone claiming to be Resultant’s help desk, offering to fix the problem. The attackers are impersonating us, the people our clients are supposed to trust. The playbook isn’t new. Microsoft documented a ransomware group in 2024 using Teams to send messages and place calls while posing as IT or help desk staff. What’s new is how polished the approach has become and how fast it’s spreading.

Then, look at the broader world. This week in France, refrigeration systems at Carrefour, Monoprix, Intermarché, Coopérative U, and other chains heated up to as much as 50 degrees Celsius overnight, causing fires and food losses in hundreds of stores. Two months earlier, Claroty published research showing how flaws in a Danfoss refrigeration controller could let an intruder bypass the login. A source close to France’s prime minister told Reuters that the national cybersecurity agency had identified a vulnerability in Danfoss software, though no one has confirmed it’s the same flaw Claroty reported. Think about that gap between disclosure and damage the next time a patch sits in a change queue.

And in Japan, the country’s top cybersecurity body declared its first cyberspace emergency on October 9. One ransomware attack on a single cloud provider cascaded through 495 client organizations, and the provider acknowledged that data could only be restored from backups the customers held themselves. Japanese officials described the attacks as “saturation attacks” that use AI to scale against legacy infrastructure.

AI changed the math, and our decision-making hasn’t caught up

This week, Microsoft shipped fixes for more than 1,400 vulnerabilities in a single Patch Tuesday, more than it patched in all of 2025. Microsoft acknowledges the pace of vulnerability discovery and repair is increasing due to AI.

At that volume, the slowest part of any response is deciding who acts. During an active threat, someone must maintain the operating picture, establish priorities, coordinate technical and business stakeholders, document decisions, and escalate issues that exceed delegated authority. That person doesn’t need to make every decision, but the response needs a clearly designated leader who ensures decisions are made at the speed the situation requires. Without that structure, even talented teams can lose valuable time waiting for someone else to take ownership.

Attackers now produce more attacks, and better ones, at almost no cost. Once they’re inside, they move faster than anything I’ve seen. A recent McKinsey article argues that frontier AI lets attackers move faster than companies can decide, which turns cyber into an operating-model problem.

With mid-market clients every week, I’m finding that nobody owns decision speed. IT owns patching, the business owns downtime, legal owns disclosure, and security owns risk. No one has the authority to move the company as fast as the threat requires.

Here’s what I’d ask every IT and security leader to do now.

1. Determine how long your business can run without IT.

Harvard Business School’s Hise Gibson suggests asking your board, “Can the business operate for 48 hours without digital systems?” If they can’t answer with a confident yes, you’ve found your first project. Start with the small set of systems your business couldn’t survive losing. Protect and monitor those first, then work outward.

2. Plan for when you get breached.

At AI speed, you won’t stop every attack. How long it takes to recover determines whether a breach becomes a bad week or a lost quarter. Test your restores and know who holds your backups. The companies in Japan learned that lesson the hard way.

3. Decide in advance who can act without a meeting.

I recommend that clients name one person who can override normal change approval when a threat is confirmed, and give them a small team to work with. And if you have outsourced to an MSP, designate exactly what situations they are authorized to act without your consent. For confirmed active threats, reporting after the action should replace approval before it. McKinsey describes a financial institution that left a critical vulnerability unpatched for 11 days because no one had the authority to override a production change freeze. The company responded by giving the leader of its response team that authority.

There’s another side to the decision. Applying an emergency patch can introduce operational risk, particularly in manufacturing, healthcare, and other environments where system availability affects production or safety. The right decision isn’t always to patch immediately. Sometimes temporary isolation, restricting access, disabling a vulnerable service, or implementing compensating controls reduces the immediate exposure while allowing for a controlled change. What matters is having someone authorized to evaluate both risks and make the decision quickly.

I made my two-hour call on the fly, with no policy behind me. That kind of decision should be written down ahead of time, giving authority which is bounded, communicated, and approved.

4. Trust your people and give them permission to be rude.

The 2023 MGM Resorts ransomware attack started with a ten-minute phone call from someone impersonating an employee. Your users need explicit permission to hang up on “the help desk” and call back on a known number. Your engineers need to know you’ll back their judgment at 2:00 a.m.

5. Test your emergency decision process, not just your technical response.

Run a tabletop exercise where a critical vulnerability is actively exploited, the primary client contact is unavailable, and patching could interrupt a business-critical system. Can your team identify who has authority, what actions are permitted, how the business impact will be assessed, and when leadership must be notified? If those answers aren’t clear during an exercise, they won’t become clearer during a real incident.

Same governance; different timing

Everything I’ve described here is still governance. The difference is in the timing. Leaders agree on the rules and limits before an emergency, then let the team handling the threat act as fast as it needs to in the moment.

So, here’s my question. If your managed services provider called tomorrow and said, “We patched without asking,” would you be angry or relieved? Your honest answer tells you a lot about whether your governance is ready for what’s coming.