Recently I was testing a feature in SQL Server on 2017 and 2019. There was supposed to be an improvement across versions, but I didn't see it. Then I realized that I was on SQL Server 2019 CU 2 on my laptop, and the current CU is 17. I took a few minutes to download that and install it.

I have often been a lagging patcher in production environments, often looking to stay a CU or two behind, depending on my workload. SQL Server has been a very security -table platform, so that's often worked well, though there are security updates at times. For those, I usually prioritize a patch getting applied.

Windows (Linux, MacOS, etc.) tends to get patched more often than other software, especially by administrators. At least on desktops. Servers sometimes lag a bit, which can be a problem. I saw this week that a lot of attacks in 2022 Q2 were for a vulnerability Microsoft patched in Sep 2021 but hadn't gotten all their customers to apply the patch. That situation was a problem early in my career with many vulnerabilities, and it's still apparently an issue now.

If you're wondering how big a deal patching can be, remember the Equifax hack? This occurred because administrators hadn't patched a system. Whether it's a host OS, a database platform, or some other software system, it's important that you keep somewhat current with patches. We never know when vulnerabilities will appear, and honestly, for most of us, we can't spend the time tracking every piece of software and the various vendor disclosures.

We can, however, patch relatively quickly. While I don't expect that most, or even many, people will patch within a month, I do think that delaying six months is probably a bit long. That being said, I need to check a few of my servers and make sure my admins are keeping them up to date.