The Security Patch Dilemma Is Becoming a Customer Experience Crisis

An eventful Cybersecurity Awareness Month has brought fresh vulnerabilities and urgent patching demands. For customer-facing businesses, the challenge is keeping services secure without leaving customers exposed or disrupting the experiences they depend on.

October has been an especially eventful Cybersecurity Awareness Month. Vulnerabilities that were uncovered in the PHP web programming language have prompted urgent warnings to inventory and patch exposed systems, while disclosures affecting a range of other software development tools and web infrastructure, have added to security teams’ workloads.

Customer have felt the consequences of this mounting workload in two ways: through service disruptions caused by organizations racing to fix the flaws and security failures that put their data at risk.

That leaves businesses facing an uncomfortable choice. Patching live systems can interrupt essential services, trigger compensation claims and damage customer relationships. But delaying fixes leaves potential routes for attackers to exploit. As AI accelerates vulnerability discovery, organizations have less time to resolve this tension before the issue demands attention.

Research from Chainguard indicates the scale of the challenge. More than three-quarters of security leaders surveyed said they had experienced a confirmed or suspected AI-driven attack in the past year, while 54 percent admitted their organizations knowingly leave high or critical vulnerabilities unpatched at least some of the time.

As Quincy Castro, Chief Information Security Officer (CISO) at Chainguard , told CX Today , these findings indicate established security processes are struggling to keep pace, with consequences for the people and businesses relying on the services those systems support.

“All of the existing processes around vulnerability handling are just creaking at the seams.”

“All of the existing processes around vulnerability handling are just creaking at the seams.”

AI is intensifying longstanding difficulties in getting security, engineering and business teams to agree on priorities and allocate limited resources.

When a Security Fix Becomes a Customer Service Problem

For businesses operating complex technology environments, applying a patch can have consequences far beyond the security team. An upgrade might protect customer information against an emerging threat but also cause a payment service to fail, prevent users from accessing their accounts or interrupt a business customer's operations.

“When we don't have reliable underlying infrastructure, when there's uncertainty the consequences of applying patches to live systems, when we allow technical debt to accrue in environments, what ends up happening is organizations get themselves in a position where applying a patch becomes something that risks disrupting customers,” Castro said.

Historically, organizations could sometimes absorb the impact of emergency upgrades. Support teams could handle complaints, account managers could reassure affected customers and businesses could offer credits to compensate for disruption.

But repeated maintenance incidents can erode confidence, particularly when customers depend on a service. Support teams also face a growing workload as they explain outages and resolve problems caused by fixes.

Castro said AI-driven discovery is increasing the frequency with which organizations may have to make these decisions.

“What you see with the accelerated pace of vulnerability discovery with Frontier AI is suddenly, that's not once or twice a year, that's once or twice a quarter, once or twice a month, once or twice a week.”

“What you see with the accelerated pace of vulnerability discovery with Frontier AI is suddenly, that's not once or twice a year, that's once or twice a quarter, once or twice a month, once or twice a week.”

The financial exposure can extend through the supply chain. If a provider's maintenance disrupts a business customer, that customer may then struggle to serve its own users, creating a chain of complaints, lost revenue and potential contractual claims.

“Do we leave critical vulnerabilities that could compromise our entire environment live in production, or do we go upgrade people for the third time this month?” Castro asked.

This is a difficult operational calculation for customer experience leaders. Security teams must reduce exposure, while service teams need to maintain availability and deliver on promises made to customers. Treating these as separate responsibilities can leave the organization poorly equipped to manage the consequences of either decision.

PHPocalypse Threat Dominates a Week of Cyber Disruption

A wave of critical vulnerabilities and outages has put customer-facing systems under pressure this week, led by attempts to exploit PHP and a Google Cloud power event, followed by fresh warnings around AI agents, deepfake detection, open-source security and CX observability.

Shadow AI Puts Customer Data and CX at Risk as Agents Raise the Stakes