They spent half of it talking about software patches.

It’s a surprisingly pressing issue, Hurd said. In the old days, a software patch would be deployed to get ahead of a potential security threat. But in the on-premises world of information technology—that is, companies running their own servers and databases, rather than outsourcing it in the newer model known as cloud computing—it would take a year to get that patch to customers. And that spells trouble.

“Do you want to be in front of U.S. Congress and say that your IT team missed a patch?” Hurd asked the audience assembled at the Wall Street Journal’s D.Live conference in Laguna Beach. Or do you want to let the professionals at Oracle and its competitors—Amazon, SAP, Google, and so forth—do it instead?

“This patching thing, while it may sound very trivial…this is really, really flippin’ hard,” Hurd said.

It’s a small part of Oracle’s massive, long-term transition to cloud computing. As Fortune 1000 companies make over their IT operations, Oracle is doing the same to its business model. It’s exhilarating, exhausting, and challenging on all fronts, Hurd seemed to suggest.

“Our industry is going through a secular change that’s generational. This will be a 10-, 15-year run to get there,” he said. “What’s happening in tech is [that it’s] all being challenged now. We’re cannibalizing ourselves.”

That means a change in speed. “The environment in IT today is not sustainable. It will have to change,” Hurd said. “The risk of your current IT environment from a security perspective? It has to change.”

That means a change in strategy. “You have a choice: I can kick this can down the road and possibly get through it” or you can truly change, Hurd said.

And that means a change in expectations.

“Markets aren’t patient for performance,” Hurd said. “So if you want to go through a transition you’ve got to have some level of patience.”