Critical CMS alert puts patching obligations under insurance spotlight

Australian regulators and insurers are embedding patch management obligations directly into cyber insurance policies, with coverage exclusions now triggered at 3-45 days post-CVE disclosure. AI-accelerated vulnerability exploitation is compressing the patching window, whilst SME cyber insurance take-up falls to 3.7% despite rising claim frequency. If you run a SaaS or e-commerce platform serving Australian SMEs, your customers' cyber insurance now excludes claims from unpatched CVEs over 3 weeks old. That's a coverage trigger you now own—delay patching and your customer's insurance evaporates, and they'll come after you for breach indemnity.