Why faster-moving cyber threats require a new approach to enterprise software security.
The cybersecurity landscape is changing faster than traditional enterprise software maintenance practices can accommodate.
According to Microsoft’s 2026 Digital Defense Report, nearly 40,000 Common Vulnerabilities and Exposures (CVEs) were published in the first half of 2026. The Q3 number is larger than an entire years’ worth of vulnerabilities before 2024. AI is accelerating vulnerability discovery and exploitation, further reducing the time organizations have to respond.
Yet much of the enterprise software industry continues to operate on release schedules designed for a different era. Some providers deliver only one or two software releases annually, with security patches issued just a few times per year.
That approach is increasingly difficult to reconcile with today’s threat environment.
Security updates can no longer be treated as occasional maintenance events.
At Jama Software, we’re taking a different approach.
More Frequent Patching Is the New Normal
As vulnerabilities increase in volume and urgency, software providers must respond more quickly.
For Jama Connect, this means customers should expect more frequent security maintenance releases, potentially averaging one per week. For self-hosted customers, incremental releases such as 9.42.X will become a normal part of maintaining the platform.
This is a deliberate departure from the infrequent release cycles still common in enterprise software.
Rather than waiting for the next major release to address emerging vulnerabilities, our approach prioritizes making security fixes available as they are developed and validated.
Frequent patches should not be interpreted as a sign of software instability. They demonstrate an active commitment to identifying and addressing security risks.
The measure of a software provider’s security commitment is not how few patches it releases, but how quickly it responds to emerging threats.
Reducing the Burden on IT
More frequent patches create a practical challenge for customers.
Every self-hosted update requires planning, testing, approvals, and deployment. At a weekly cadence, this can quickly overwhelm IT departments already managing numerous applications and competing priorities.
This is one reason Jama Software offers cloud and CVC (Customer Validated Cloud) solutions built on a multi-tenant Software-as-a-Service (SaaS) architecture.
Unlike traditional self-hosted software, our SaaS offerings eliminate the need for customers to individually deploy and maintain application updates. Jama Software manages the software lifecycle centrally, allowing security improvements to be delivered across the service without requiring each customer’s IT team to execute a separate upgrade.
This model is particularly well suited to an environment where security updates must occur frequently.
For organizations evaluating their long-term software strategy, the distinction is increasingly important: SaaS is not simply an alternative deployment model. It is an operating model designed to keep pace with continuous security maintenance.
Supporting Self-Hosted and Air-Gapped Environments
We recognize that some customers cannot move to SaaS because of regulatory, security, or operational requirements.
For these organizations, Jama Software remains committed to supporting self-hosted deployments and providing timely security updates.
Air-gapped and highly isolated environments can provide an additional layer of protection by limiting exposure to external threats. These controls can be particularly valuable when operational constraints complicate immediate patch deployment.
However, isolation does not eliminate vulnerabilities or replace the need for security updates. Customers should continue to assess and apply patches based on their security requirements, with compensating controls helping manage risk where immediate remediation is not feasible.
Our objective is to provide customers with the flexibility to meet their specific requirements without compromising our commitment to security.
A Responsible Approach to Vulnerability Disclosure
The speed of modern cyberattacks also changes how vendors should communicate about vulnerabilities.
Publishing detailed information about exactly which vulnerabilities a patch addresses can inadvertently provide attackers with a roadmap to target customers who have not yet updated.
For this reason, Jama Software will not publicly publish detailed vulnerability-to-patch mappings. We will communicate the availability and importance of security updates while managing sensitive vulnerability information responsibly, including any required customer notifications or coordinated disclosures.
Our priority is protecting customers, including those who have not yet deployed the latest release.
Setting a Higher Standard for Enterprise Software Security
The enterprise software industry must move beyond the assumption that a handful of releases and security patches each year is sufficient.
As vulnerability discovery and exploitation accelerate, customers should expect their software providers to respond with greater speed and consistency.
Jama Software is embracing that responsibility through more frequent security updates, a multi-tenant SaaS architecture that reduces customer maintenance demands, continued support for self-hosted environments, and responsible vulnerability communication.
