31%
Vulnerability exploitation
The leading initial-access vector in the Verizon 2026 DBIR.
A general breach statistic. It does not claim missed reboots caused those incidents.
Verizon 2026 DBIRWhy the restart matters
A pending reboot is a system state.
A patch can be downloaded and even installed while the machine is still waiting on a restart. Until that restart finishes, remediation may be incomplete. That is not the same claim as “every pending reboot is an active breach.”
Reboot IQ keeps that state visible inside ConnectWise Automate: the cause, how long it has waited, and whether the restart was verified.
- Update installedThe package is on the machine. The restart may still be pending.
- Restart requiredServices and components may still be running the previous version.
- Restart verifiedHistory shows the reboot completed, not just that it was scheduled.
Why it matters
Unfinished remediation stays in the fleet.
These figures describe the wider stakes. They do not assign a breach, or its cost, to a missed reboot.
43 days
Known-exploited median
Median time to fully remediate known-exploited vulnerabilities in that dataset.
Not a restart timer, and not the median for every critical CVE.
Verizon 2026 DBIR32%
Exploit entry
Mandiant M-Trends 2026: exploits began 32% of intrusions with a known entry point.
Not a reboot-specific breach statistic.
M-Trends 2026$10.22M
U.S. breach cost
IBM’s 2025 average U.S. data breach cost. The scale of a breach.
Not a cost caused by one missed reboot.
IBM 2025Restart policy
Give users flexibility. Give IT a deadline.
The 24–72 hour range is a practical choice for routine Windows security updates where operations allow. It is not a Microsoft mandate.
- 01Update installed
The patch is on the endpoint. The restart may still be open.
- 02Grace period
Message the user and give routine updates room to finish the workday.
- 03Reminder
Keep the machine on the queue while the grace period is still running.
- 04Deadline
Schedule the restart in the machine’s local time, or escalate if it slips.
- 05Restart verified
History and the audit log show that the reboot actually completed.
Routine security update
Aim for 24–72 hours where operations allow. Message the user, then schedule the restart in local time.
Known exploited
Treat CISA KEV items as urgent. Shorten the grace period and keep the machine visible until the restart is verified.
Workstations and servers
Workstations get a grace period, then a deadline. Servers stay inside a maintenance window.
Past the SLA
If a restart stays pending past the policy, alert and escalate instead of leaving it in the queue.
Guidance
The restart is part of the update.
Microsoft
An update can remain restart-pending. Until that restart finishes, installation is not complete.
Microsoft LearnNIST
Patch management includes confirming the change has taken effect, which can require a reboot.
NIST SP 800-40 Rev. 4CISA
Prioritize timely remediation of vulnerabilities that are known to be exploited.
CISA KEVUK NCSC
Install updates promptly — ideally within a few days. Some updates are not in place until the device restarts.
UK NCSCSee the machines still waiting.
Detection, local-time scheduling, and the audit trail live in the same ConnectWise Automate plugin.