Security<\/p>\n
More patches mean more reasons to buy Redmond\u2019s auto-patching tools<\/p>\n
Microsoft has warned customers to expect more security patches for the foreseeable future, thanks to AI.<\/p>\n
\u201cAs AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release,\u201d the company\u2019s executive veep for Windows + Devices, Pavan Davuluri, wrote in a Thursday post<\/a> that describes how Microsoft is changing its internal processes to spot software vulnerabilities using AI.<\/p>\n His post later points out that Microsoft offers many fine tools to automate patching, and his view that customers who use them will be able to keep pace with increased volumes of patches.<\/p>\n Davuluri\u2019s post argues that investment in automated patching tools is justifiable and sensible because Microsoft\u2019s use of AI to deliver more patches improves overall security.<\/p>\n \u201cBy applying AI across security analysis, we can identify patterns faster, prioritize risk and scale vulnerability discovery across the Windows codebase,\u201d he wrote. Sometimes that might mean Microsoft products contain fewer vulnerabilities.<\/p>\n \u201cWe continue to evolve our internal systems and practices so that vulnerability discovery is not treated as a separate activity, but as part of how we build, review and improve Windows before new features or updates are released,\u201d he wrote.<\/p>\n The post explains that Microsoft uses a tool called the multi-model agentic scanning harness (MDASH), which apparently \u201cutilizes multiple models including leading third-party AI vulnerability discovery models.\u201d<\/p>\n \u201cTo run MDASH at Windows scale, Windows set up dedicated cloud infrastructure for scanning and proving,\u201d Davuluri wrote. \u201cA scanner pipeline scans critical binaries and validates candidates using multi-model debate across multiple model families. Confirmed candidates then flow to a separate, Windows-specific prove pipeline that helps eliminate remaining false positives, so only the highest-confidence findings reach the engineering team.\u201d<\/p>\n The executive veep said that process \u201chandle a larger volume of potential vulnerabilities and shortens the review window for new ones, shrinking the attack window for zero-day exploits.\u201d<\/p>\n