"In most companies, security and operations are split into two groups," said Storms. "That sets up a classic conflict. Security cares about patching, operations cares about uptime."

Some firms deal with the conflict by running a lab where the security team can replicate the firm's production systems and use those for patch testing. Other companies rely on redundancy to prevent a company-wide failure of email and databases.

In any case, IT administrators like to go slowly when dealing with Exchange and SQL Server to ensure that updates don't cause unexpected downtime. "It could take some enterprises months to patch all their Exchange nodes," Storms said.

The last time Microsoft patched any version of Exchange was December 2010, when it updated Exchange Server 2007. The update set for next week will affect Exchange Server 2007 and the current Exchange Server 2010.

"And it's not like you can ignore the Exchange patch," said Storms. "It's a zero-day."