With AI assisted attackers everywhere, and critical bugs being found daily (another critical linux bug yesterday), patching is no longer a quarterly project.. it is a treadmill. Like the old joke about painting a bridge, by the time you reach the far end you have to walk back to the start and begin again.
Your "platform" is not one piece of software. It is your server OS, your container runtime or vm hypervisor, your gitops controller, your policy engine, your security suite, your observability stack, your servicmesh/ingress, your authentication and authorization layer, and whatever other tooling got bolted on along the way. Each one has its own release cadence, its own CVEs, its own breaking changes and its own upgrade path.. and every one of them needs to stay current.
Then there is the open source angle. The code is public, so attackers can point their vulnerability discovery tooling straight at it, with no reverse engineering needed. They start with a head start on you.
Every project you add to a CNCF based kubernetes management stack is another thing on the treadmill, and the more components you run, the more you have to update, and the more chances one slips through unpatched. Complexity has become a security risk, whether we want to accept it or not.
To all the platform engineers out there.. how often are you really patching your platform, and how many components does that include??
In this new world, we need less software, not more.. fewer moving parts to maintain, fewer points of exposure, and whatever you run, you better ensure that vendor fixes their bugs fast.
If you are not patching your platform weekly, you are an incident waiting to happen.
