Microsoft has introduced a massive security update package addressing a total of 1118 vulnerabilities across various software products and the Windows operating system. Alongside a record number of closed security gaps, the company implemented a fundamentally new approach to threat classification, dividing them into 15 specialized risk cohorts to optimize IT professionals' workflows.
The Essence of the New Approach and Risk Cohorts
The traditional security audit process requires administrators and analysts to thoroughly examine each individual vulnerability based on CVE identifiers. This includes assessing severity levels, affected components, attack implementation conditions, and exploitation status. To eliminate duplicate routine work when deploying gigantic patch packages, developers grouped vulnerabilities into so-called "risk cohorts." They are based not on common root causes, but on similar types of analytical checks needed to evaluate the environment.
Vulnerability Distribution Across Categories
The largest risk cohort in the current package targets Windows file systems, data storage, and backup mechanisms, accounting for 136 vulnerabilities dealing with potentially unsafe data. This is followed by office applications and email clients (135 vulnerabilities), as well as graphics, multimedia, and content processing components (131 vulnerabilities). Additionally, large-scale fixes affected the system kernel (109 entries), installation and deployment services (103 entries), alongside network infrastructure, peripherals, and cryptographic subsystems.
Contradictory Data
While official figures from the company's latest global release state 1118 fixed vulnerabilities, independent sources and industry reports from previous periods show different scales for monthly patches. For instance, specialized media previously recorded both smaller packages of 173 vulnerabilities and record releases reaching 1400 fixes. Such discrepancies are related to data collection dynamics across various Microsoft software ecosystems and the variability of CVE counting methodologies in monthly support cycles.
Expert Significance and Limitations
The presented risk cohorts are strictly analytical in nature: they do not replace the official Security Update Guide, do not change patch deployment priorities, and do not cancel the need to check for active exploit deployment. Nevertheless, the new systematic approach allows IT departments to significantly reduce preliminary infrastructure audit time, ensuring a comprehensive understanding of cyber threats across all patch installation stages.
