Patching Window Collapse: What Exploit of Web-Facing Software Rising Means for UK Businesses

Exploitation of vulnerabilities is now the most common way attackers get into organisations, at 31% of breaches, while credential abuse has fallen to 13%, according to the Verizon 2026 Data Breach Investigations Report. In plain terms: more businesses are being breached through unpatched or poorly tested web-facing software than through stolen passwords. If you run a website, a hosted system, a portal or anything that uses AI, the weakest point has shifted towards software you may barely think about between projects.

What actually changed in the threat picture?

The shift is about what attackers reach for first, not a new class of magic attack. Two findings tell the story.

First, attackers go at web applications directly. In the report's Basic Web Application Attacks pattern, covering attacks that hit a web application and then stop, there were 3,217 incidents, of which 2,281 involved confirmed data disclosure. All of those threat actors were external, and the motives were financial (74%), espionage (23%) and ideology (3%). Verizon's 2026 Data Breach Investigations Report sums this up as closer to leaving a door open than to a sophisticated heist, and the data backs that: credentials (52%), internal data (48%), other data (33%) and secrets (15%) were the most commonly compromised.

Second, using stolen credentials is still the top single action in that pattern, but vulnerability exploitation has risen, joined by password dumping and brute force close behind. That means the easy wins for attackers are known flaws and weak identity, not clever zero-days.

Why patching is not keeping up

The uncomfortable part is the maintenance curve. According to the same Verizon 2026 report, only 26% of critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalogue were fully remediated in 2025, down from 38%. Median time to full resolution rose to 43 days from 32, and breaches involving a third party reached 48% of the total.

Read that as a business owner rather than a security analyst. You are probably not failing because someone is out to get you specifically. You are exposed because a component in your stack, a plugin, a library or an integration has a known flaw, and nobody has checked or updated it. Third-party exposure matters, because 48% of breaches involved a third party. If a supplier's software or a partner's integration sits in front of your data, their patching discipline is your risk.

Does this apply to a small UK business, or just big targets?

It applies to anyone with an internet-facing login, form or data store, which in practice means most businesses with a website, store or custom system. Attackers automate this work, so being small is no defence. The questions to ask are practical ones:

• Which of our systems are reachable from the internet, including portals, booking tools and admin areas?
• Who is responsible for applying security updates, and how quickly after release?
• Which third parties hold a connection into our systems or data?
• Are we testing what is actually running, not just what we designed?

If you cannot answer the second and fourth questions quickly, that is your priority, not a new website.

What should you do now? A practical sequence

The core insight from the web application security guidance from DeepStrike is that this is mostly an application problem, not a perimeter one. A firewall cannot tell that one customer should not see another customer's invoice. Only the application knows who owns a record, so the check has to live in the code. That is why testing matters as much as patching.

1. Inventory what is exposed. List every login, form, API and integration that faces the public internet. Include systems you inherited and anything a former supplier built.
2. Get patch ownership into a named person. Not a team, a person, with a target turnaround for critical fixes. Third-party components count.
3. Test what is running. A design review will not find a misconfigured permission. Testing the live system does.
4. Fix identity basics. Since stolen credentials remain a top action, tighten logins, remove dormant accounts and turn on multi-factor authentication where you can.
5. Repeat on a schedule. One test is a snapshot. A regular cadence is what keeps the gap closed.

For the testing step, see how we approach testing and QA for websites and software, including checking permissions, input handling and third-party components.

Which standard should you test against?

You do not need to invent your own checklist. OWASP maintains two useful public references. The OWASP Web Security Testing Guide is the flagship testing resource for web application developers and security professionals, currently at version 4.2, with 192 contributors. The OWASP Top 10 tells you what goes wrong most often, while OWASP ASVS sets out what secure enough looks like for your risk level, as the DeepStrike guide explains.

For UK businesses, Cyber Essentials is a sensible baseline to hold alongside that. Varsuite is Cyber Essentials certified, and we apply the same discipline to the systems we build. Certification is not a guarantee of security, and nobody honest will tell you otherwise: it is a floor, not a finish line.

Where AI fits, and where the risk sits

AI agents are now part of how software gets built and run, which cuts both ways. They speed up development and testing, and they also mean more code, more integrations and more places where permissions can be wrong. If you have added an AI assistant, a chatbot or an automated workflow to your site or systems, treat it as another internet-facing component: it needs an owner, a test and a patch path. Our overview of AI agents covers what we build and how we scope it.

On the offensive side, sessions on web application security in 2026 have focused on autonomous agents and shortened patching windows, with one session describing web and API attacks more than doubling in the first half of 2026. Treat that as a signal rather than a precise benchmark: the direction is clear even if the number is vendor-sourced.

How to compare your options fairly

There are three realistic routes, and they suit different situations.

There is no single right answer. A specialist firm is often the better call for a large, complex or regulated estate. We are not the right fit if you need a pure penetration testing house with CREST-accredited testers, and we will say so rather than stretch the brief.

Where Varsuite fits

Varsuite builds websites, bespoke systems, e-commerce and AI agents, and we run them. Because our AI agents design, build and test the work and our human team perfects every detail before it ships, testing is part of delivery rather than an afterthought. We are UK-based, Cyber Essentials certified, and we work in pounds sterling with prices we publish: brochure websites from £600 with a £100 per month care plan, online stores from £1,200 with a £150 per month care plan, custom CRMs from £1,700 with £150 per month for hosting and care, custom software and AI agents from £1,000, and retained development from £2,000 per month. A PSA system is a custom build priced by quote.

If you want to see how we handle ongoing quality, our always improving approach explains the maintenance cycle, and our security monitoring service covers the monitoring side.

The sensible next step

If you recognise your own setup in this article, start with a short, focused test of the systems that face the internet and a named person to own patching. You can talk to us about a practical test plan or review our testing and QA service to see what we check. Either way, the useful move today is to find out what is exposed, not to wait for a quiet month.

Frequently asked questions

Is unpatched software really a bigger risk than weak passwords?

For initial access, yes, based on current evidence. The Verizon 2026 report found exploitation of vulnerabilities to be the most common initial access vector at 31%, with credential abuse at 13%. Stolen credentials still matter, so treat both as priorities rather than choosing one.

How quickly should we patch a critical vulnerability?

The research does not set a target for you, and the honest answer is as fast as you can, with a named owner. What the Verizon data does show is that the median time to full resolution rose to 43 days in 2025, so most organisations are not moving fast.

Does Cyber Essentials mean our website is secure?

No. Varsuite is Cyber Essentials certified, but certification is a baseline and does not guarantee security. It shows you have core controls in place. It does not replace testing of your live application, where permission and input handling problems are only found by testing what is running.

Do we need a penetration test or just better maintenance?

Both serve different purposes. Testing tells you what is currently wrong; maintenance keeps it from going wrong again. For a small business, the practical combination is a regular test against a recognised standard such as the OWASP Web Security Testing Guide, plus a named person responsible for patching.