This chart tracks the growth in CVEs (Common Vulnerabilities and Exposures) for the past 20 odd years. These are publicly catalogued cybersecurity vulnerabilities that may impact supplier software that NHS software suppliers and trust security teams must assess, prioritise and address to protect clinical systems, sometimes as urgent patches requiring immediate update.
When I started building software professionally in 2006, that figure was around 6,500 vulnerabilities per year.
The projection shown for this year points towards roughly 100,000 in a single year, and the growth trajectory suggests future years will be much worse.
It’s hard to ignore the parallel between rapid improvements in AI model capabilities over the last three to four years and the accelerating growth in reported CVEs. AI is helping researchers uncover longstanding vulnerabilities and turn previously impractical attacks into working exploits. I expect the pressure on suppliers and trust security teams to continue growing with much more regular emergency patching or vendor software.
As Chief Product and Technology Officer at xWave, that gets my attention. But we've built the technology and engineering practices to keep pace, provided we continue to invest consistently.
A key part of how I approach technology planning and budgeting is highlighting the cost and risk of not investing in continuous improvements to our infrastructure and non-functional requirements, including security, scalability, observability, reliability and performance. These investments may not always deliver immediately visible features, but they are fundamental to building resilient, secure and scalable products that can evolve with our customers' needs.
This week’s PHP security release was a practical example, with a portion of our backend built on PHP. AI helped researchers turn longstanding flaws into working exploits. Within hours of learning about the issue, we were reading reports of proof-of-concept exploits and reports of exploitation attempts soon followed.
We patched xWave’s production environment within eight hours of learning about the vulnerability.
Credit to the PHP team for releasing the fix so quickly, and to our engineers for testing and deploying it. That response also depended on decisions made long before the vulnerability appeared:
Infrastructure as code.
Repeatable deployments.
Maintained dependencies.
Automated testing.
Consistent environments.
We will still retro this next week though and see what we can do better the next time this happens, which is unfortunately likely to be sooner rather than later.
For NHS CIOs and teams managing order communications, CDS, RIS/LIMS and all other systems, the question is: How quickly can your supplier deploy an urgent patch across every affected customer environment?
If deployment requires individual projects, manual server changes, operating system upgrades or replacement hardware, the response becomes a queue.
If a supplier can update only a small proportion of its installed base each month, how will it handle overlapping vulnerabilities alongside normal delivery?
During procurement and contracting, trusts need to consider how suppliers address these issues. How have they invested in their architecture, infrastructure and deployment processes? How easily can their systems evolve as technology changes and new vulnerabilities emerge?
That capability needs to be maintained throughout the contract. Speak to existing customers about how updates are delivered, how quickly urgent issues are resolved, and where the cost and responsibility fall when infrastructure needs to change.
On-premises systems can be patched quickly. Cloud systems still require disciplined engineering. Architecture and ongoing investment matter in both.
Established software can serve the NHS for decades while its foundations evolve. “Legacy” should never become an excuse for leaving those foundations untouched.
At xWave, we invest in those foundations because our customers depend on our ability to respond.
An installed base demonstrates experience. The ability to keep that entire estate maintained and supported deserves just as much scrutiny.
