I was updating the SQL Server build lists the other day. I typically get a notification from Microsoft when new builds are released. This is something that happens every month as a new CU appears. For the older versions (2022, 2019, 2017), we get a CU every other month. Since SQL Server 2025 is new, we're getting a CU a month, which will slow down next year. However, I've also seen this for the versions:

• Oct 2026 - GDR
• Sep 2026 - GDR
• Jul 2026 - GDR
• May 2026 - GDR
• Apr 2026 - GDR
• Mar 2026 - GDR

That's a lot of out-of-band patches. In the last decade of SQL Server, there have been relatively few GDRs. Often the main CU comes a day or two later (or a month later for older versions). If you react and start to plan patching, you might find yourself trying to decide if you apply CU9+GDR or wait for CU10, or do both.

There have been few GDRs in the last , but before that, relatively few: three in 2025, two in 2024, and two in 2023. I suspect that AI is being used to discover bugs in existing software, and this is forcing Microsoft to perform remediation work. Brent posted a similar thing, noticing a large number of security fixes and speculating that AI is finding issues.

That's good, right?

Or is it? If Microsoft can find security issues, can't malicious actors? Including nation-state-sponsored hackers? I'm not even sure that Microsoft is finding most of these, as there are lots of CVE issues, which can be discovered by anyone and sent to Microsoft. This might be to obtain a bug bounty payment, as Microsoft and other vendors will pay security researchers.

Or it could be that a hacker finds an issue and exploits it. A customer then notices an issue and reports a problem to support. Microsoft realizes there is a vulnerability, works on a fix and reports the issue to the CVE database.

AI is great for security, as it can scan software and look for known issues. We have decades of security bugs that have to be included in the frontier LLM training, so using AI to scan your code is a good idea. I am sure code scanning tools are adding AI review to their systems. I'm also sure those vendors are worried you'll use AI on your own to scan code and find your own issues.

You can do that, but ensuring your AI does a good job scanning isn't necessarily easy. Or fast. Deterministic systems, like SonarQube and Flyway can find code issues quickly, in a deterministic fashion, and likely with less cost than AI. That's not to say AI doesn't have a place, but it's likely an out-of-pipeline review that takes place less often than every CI build.

Security is a constant battle, and it's hard. The age of AI makes it easier and harder (and more expensive) to manage security, but I think that's a good thing. We're seeing lots of vulnerabilities, but also more patches. Perhaps the better outcome is that there is more awareness and focus on security from vendors who now know if they don't scan their code carefully, someone else will. Perhaps someone they don't want finding issues.