PRINCE FREDERICK — Calvert County’s technology staff usually install fixes for about 40 software vulnerabilities a month. In the most recent cycle, they had 1,400.
Kat Poff of the county’s Department of Technology Services shared the figure with the Board of County Commissioners on Oct. 20 as the board proclaimed October Cybersecurity Awareness Month. Most of the flaws are not new, she said. Many have existed for years, but the tools to find them did not.
“Not only do we have the tools, the bad guys have the tools as well,” Poff said, pointing to the spread of artificial intelligence as one reason attacks have become harder to detect.
The county applies vendor patches once a month, usually on the last Friday, Poff said. A 35-fold jump in one cycle means far more fixes to test and install in the same window, on the systems the county’s own proclamation calls essential to the public services residents rely on every day.
A national surge
Calvert’s experience tracks a broader trend. Microsoft fixed a then-record 206 vulnerabilities in its June 2026 monthly update, and a Microsoft engineering executive said releases that large could become normal because of AI-assisted discovery, Dark Reading reported.
The numbers kept climbing. Microsoft’s July release fixed 570 flaws and its August release 398, according to an August research note from the Cloud Security Alliance, which warned that AI tools are finding flaws faster than organizations can test and install fixes.
Poff told commissioners that keeping up is not a job her department can do alone. “This is all hands on deck,” she said, calling cybersecurity “everyone’s responsibility.”
Commissioner Mike Hart presented the proclamation, which urges residents, businesses and county employees to use strong passwords, turn on multi-factor authentication, report phishing attempts and keep devices updated. The county has been recognized for its technology work before, most recently ranking sixth nationally in the 2026 Digital Counties Survey.
Employees phishing employees
The same meeting featured the county’s third annual Phish Master contest, in which county employees write realistic phishing emails that the Technology Services department then sends to their co-workers. The entry whose fake link draws the most clicks wins a trophy.
Employee-written lures work better than the department’s own, Poff said. Her usual simulated phishing click rate of about 1% jumps to about 5% when the contest emails go out, she said, often because employees build in details specific to Calvert County. She called that a good sign: it shows staff are learning to think the way attackers do.
This year’s winner is Michael Sainte-Marie of the Technology Services service desk. His winning email posed as a message from Workday, the system the county uses for pay, and asked recipients to review a pay matter “at your earliest convenience,” made to look automated.
The lesson, he told commissioners, is to pay close attention. When an email claims to come from a system you use, log into that system directly to check, rather than clicking the link in the message.
