Patching is one thing the software industry does all the time, but almost never well and never enough. For some other problems, e.g., memory safety and input validation, we made progress by understanding the problems were and how to do better based on science. Yet for patching it remains unclear what its core scientific problems are, where they need to be addressed, and what abstractions must be developed or changed. This lack of clarity holds back both traditional computer science research approaches and AI automation---for AI to be effective, it must be told what problems it must solve, and how to check if it actually did.  I will talk about my attempts to define the problems of patching, during my time at DARPA and beyond.