A Bank Hired 1,000 People to Patch. You Shouldn't Have To.

A bank hired 1,000 people to patch. You shouldn't have to.

Picture the meeting at Bank of America.

Someone puts a slide up. AI just found more holes in our software than we've ever seen. The room goes quiet. And then somebody says the only thing that makes sense when you're one of the biggest banks on earth: hire more people.

So they did. 1,000 contractors, on top of roughly 3,000 people already doing the work. All to patch flaws turned up by AI models like Anthropic's Mythos. CEO Brian Moynihan said the cleanup, together with the bank's anti-money-laundering work, ran "a couple of hundred million plus" in a single quarter.

Now picture your meeting. Same slide. Same quiet room. Except nobody's approving 1,000 new hires. You've got the team you've got. And Patch Tuesday is never more than a few weeks away.

Real users shouldn't be your patch test.

What actually changed

In April, Anthropic launched Project Glasswing with Microsoft, Apple, Google, AWS and others. The star was Claude Mythos, a model that hunts for software bugs. Within weeks it had flagged more than 10,000 high- or critical-severity issues.

Mozilla's CTO, Bobby Holley, summed it up after Mythos found 271 flaws in Firefox: "So far we've found no category or complexity of vulnerability that humans can find that this model can't."

That's great news for defenders. Sort of. Because every one of those bugs turns into a patch. And every patch lands on your desk.

The pile is real

If you've felt like Patch Tuesday got heavier this year, you're not imagining it. Microsoft's monthly patch load grew about 17x in 2026.

Core Microsoft CVEs per release. Sources: Brinqa (Q1, June), Tenable (July–September), ZDI via Security Affairs (October).

October alone was bigger than any full year Microsoft had ever shipped, according to the Zero Day Initiative. Read that one twice. And that's just Microsoft, before a single third-party app update hits your queue.

The race you didn't sign up for

Here's the part nobody's saying out loud.

Attackers used to need about two months to turn a patch into a working exploit. Now Mandiant puts the average at seven days before the patch even exists. Meanwhile the Verizon DBIR says the median time for us to fully patch went up, from 32 days to 43.

They got faster. We got slower. Cool cool cool.

And look, we're not slow because we're lazy. We're slow because we've been burned. Everyone has the story. The patch that broke the printer driver. The update that killed the ERP client the morning of quarter-close. The CrowdStrike Friday that took down 8.5 million machines.

So we do rings. And if we're being really honest, Ring 1 is usually a handful of real coworkers who don't know they volunteered. They find the broken patch the hard way. Then they call the help desk. Then the help desk calls you.

Forrester said it plainly: "A 30-day waiting period for patching won't be acceptable in an environment where attackers can go from discovery to exploit in minutes."

You can't wait anymore. But you can't afford to break things either. That's the gap.

So we built a coworker who always goes first

Real users shouldn't be your patch test. That's the whole idea behind Ring Zero.

We gave you a user who isn't a person. We call it User Zero. It's a real Windows 365 Cloud PC that's Intune enrolled, Entra joined and persistent. It runs your apps and your policies, and nobody real is logged in. It's a production twin that's happy to take the hit.

Here's how it plays out:

1. A patch drops.

2. User Zero gets it first, installed the way Intune really installs it.

3. Ring Zero checks that your apps still launch and behave, and hands you the evidence.

4. You look at it and make the call. Pass? On to your rings. Broken? It broke on User Zero, and no one in Finance ever found out.
   
   

You don't need 1,000 contractors. You need Ring Zero.

The result:

1. Patch SLAs go from about 15 days to 1,

2. 95% lower risk than shipping patches with no validation at all.

Learn more:

 44-second explainer video | 2-minute demo | Ring Zero use case.

P.S. Ring Zero doesn't make decisions for you. A human still signs off on every patch. We just make sure you're signing with proof in your hand instead of crossed fingers.