Updates and patches: why 'remind me later' is the biggest risk in your SME

You know the window: 'Updates are available. Install now or remind me later?' It always shows up at a bad moment, so you click later. A week later, again. At many SMEs we review, devices are months behind, not out of unwillingness, but because nobody has an overview. In this article we explain what a patch actually does, what needs updating and how to organise it without bringing work to a halt.

What a patch is and why attackers wait for it

Software contains errors. Some of those errors allow an outsider to run code, read passwords or take over a device. As soon as the maker discovers such a vulnerability, they release a correction: a patch. It usually comes packaged in an ordinary update.

The problem is that the patch is also an announcement. The moment a vulnerability becomes public, attackers know exactly where to look, and they try it automatically on everything reachable online. That happens within days, sometimes hours. Anyone who has not updated by then is an open door. What we see in incidents is rarely a new trick: usually it is a vulnerability for which the patch had been available for weeks.

What needs updating (and what is often forgotten)

Windows and macOS are usually fine, because they insist on it themselves. The rest of your environment is quieter, and that is where the risk sits.

• Operating systems: Windows and macOS on every laptop and PC, including the manager's and the one at reception.
• Browsers: Chrome, Edge, Firefox and Safari. They update themselves, but only if someone closes them completely now and then.
• Office and other work programs: Word, Excel, Outlook, Teams, PDF readers.
• Phones and tablets: iOS and Android, plus the apps you use to read business email.
• Router and firewall: the device that protects your entire network, and that often has not been touched since installation.
• NAS and servers: the storage holding your files and back-ups, a favourite target for ransomware.
• Printers, cameras and other network devices: anything with a network cable or wifi runs software.
• Accounting and industry-specific software, and the plugins on your website. An outdated plugin is the most common reason an SME website gets hacked.

Turn this list into an inventory: which device, which software, who is responsible, when it was last updated. Without that list, patching remains guesswork.

Why people postpone, and how to fix that

Postponing is human and usually justified: the update wants to restart during a client meeting, or someone remembers that a previous update broke something. You do not fix that with a sterner email, but with agreements that make postponing unnecessary.

• Fixed update windows: for example every Tuesday evening or Wednesday afternoon. Everyone knows devices restart then, so nobody is caught off guard.
• Automatic updates outside working hours: let PCs update and restart at night, with the agreement that everyone saves their work and leaves the laptop on the charger.
• A test group: two or three devices receive updates a few days earlier. If something breaks, you notice it there and not across the whole team.
• Critical patches immediately: when a vendor or your IT partner flags a vulnerability as serious, you do not wait for the window. Agree on that exception in advance.

When your system no longer receives updates

Every version of an operating system has an end date. After that no patches appear, while new vulnerabilities are still found. Such a device becomes less safe every month, and the same applies to old NAS models, routers and phones whose manufacturer has stopped. What to do then, in order of preference:

1. Upgrade to a supported version if the hardware can handle it.
2. Replace the device if upgrading is not possible. Factor it into your annual IT budget so it is not a surprise.
3. If it really cannot go, for example because a machine or an old program depends on it, isolate it: no internet, no email, a separate network segment and a clear end date.

What you do not do: let the device keep running just because it still works. Working and being safe are not the same thing.

How to keep an overview, and a patch policy in five rules

The hardest part of patching is not the installing, but the overview. You get that overview in three ways: an inventory you maintain yourself, central management where an IT partner updates all devices remotely and sees their status, and monthly reporting that shows what is behind. In addition, put this policy on one page, next to your other IT agreements:

1. All devices and software are in an inventory with a responsible person.
2. Security updates are installed within the week, critical updates within 48 hours.
3. Updates run automatically outside working hours; restarts are not postponed beyond the weekend.
4. Unsupported software is replaced or isolated, never simply kept.
5. Once a month someone checks the status and reports what is behind.

Slow or strangely behaving PCs are, by the way, often a sign that updates have been postponed for a long time. Also read what to do when a computer acts up. And do not forget your Microsoft 365 environment: these eight settings belong to the same maintenance.