In all fairness, 13 days is a fairly quick turnaround for patching in the enterprise. The breach was only 6 days after disclosure. They were almost certainly in the planning stages already when this happened.

I used to be the head of IT in a large organization that worked with clients in highly regulated sectors. They all performed regular audits of our security posture. Across the board, they expected a 30 day patch policy. For high profile vulnerabilities like this one, they would often send an alert and expected imminent action within a commercially reasonable time frame. We would get it done anywhere from 24 hours to days later depending on the situation and whether there were complications. It was usually easy for us because we were patching every device and application on the network every couple weeks anyway. A hotfix is much easier to deploy when everything is up to date already and there are no prerequisite service packs. We knew we were much faster than most and it took a lot of work to get there. Thirteen days is a little slow for a 0-day by our standards but nowhere near unreasonable.

The reality is many enterprises don’t patch at all or don’t do it completely. They may patch servers but not workstations. They may patch the OS but not the applications. It’s common to find EOL software in critical areas. A friend of mine did some work for a railroad company that had XP machines controlling the track switches. There are typically glaring holes throughout the company when it comes to security. Most breaches go unreported.

Look, I hate Comcast as much as anyone. They suck. But taking 13 days to patch isn’t unreasonable. Instead, people should be asking why there weren’t other security layers in place to mitigate the vulnerability.