Business & Policy
Cost of patching and maintenance
Patching is essential, but every update consumes engineering, testing, deployment and support capacity—and can create new compatibility and assurance work.
Why it matters
Long-lived and hard-to-update devices turn a recurring technical task into a lifecycle liability, especially when suppliers, certification or field access constrain deployment.
In brief
Patching is essential, but it is not free. Each vulnerability can require investigation, backports, regression testing, release engineering, customer coordination and support across multiple maintained versions and products.
Key considerations
1. Frequency
Measure how often memory-safety issues trigger work and how many branches, variants or products must be updated.
2. Cost per release
Include engineering, security, testing, documentation, customer support, deployment and monitoring effort.
3. Residual exposure
Track devices that cannot be reached, customers that defer updates and versions that remain supported after the main branch changes.
Evidence and caveats
CHERI does not remove the need to patch logic flaws, configuration issues, protocol weaknesses or incorrectly designed privilege boundaries.
Show assumptions, ranges, dates and owners for economic or policy claims. Recheck legislation, guidance, product status and prices at the decision date.