Patching beyond Windows: apps, firmware and network equipment

Start with an inventory

You cannot patch what you have not listed. Write down every firewall, switch, wireless access point, network storage device, server, printer, camera recorder and building access controller, with its model, current firmware version and who supplies it. Add the software installed across your computers; a management tool can produce this list automatically. The exercise usually turns up surprises: a second router left in a cupboard after an office fit-out, an old storage box still sharing folders, or remote support software installed by a supplier years ago. Each one is something to update, secure or remove.

Third-party applications

Browsers update themselves if they are allowed to, but only when they are restarted, and some offices block that. Adobe Reader, Zoom, Java runtimes, 7-Zip, remote access tools and accounting add-ins each have their own update mechanism, and many only update when someone with admin rights says yes. A third-party patching tool, often part of a remote monitoring platform or available through Intune, can push approved updates centrally. Where a program cannot be patched centrally, ask whether it is still needed. Removing software nobody uses is the cheapest patch there is. Uninstalling old toolbars, trial software and duplicate PDF viewers shrinks the list you have to look after every month.

Firewalls and VPN appliances

These deserve the most urgent attention because they sit on the internet edge. Over the past few years, serious vulnerabilities in firewall and VPN products from several large vendors have been exploited at scale within days of disclosure, sometimes before a fix was available. Subscribe to the vendor's security advisories and to NCSC alerts. Keep the firewall's support subscription current, because that is usually what gives access to firmware updates. Take a configuration backup before upgrading, schedule the change for after hours, and check remote access still works afterwards. Make sure the management interface is not reachable from the internet.

Wi-Fi, switches, storage and printers

Wireless access points and managed switches typically get firmware a few times a year. Cloud-managed systems can update on a schedule you set; older standalone units need someone to log in and upload the file. Network storage devices are a favourite ransomware target, so treat their updates as security updates, not optional extras, and switch off any remote access feature you do not use. Multifunction printers run their own operating system, store scanned documents and often hold email passwords for scan-to-email. Update their firmware, change the default admin password and keep their web page off the guest network.

Servers and the bits around them

Physical servers have a management controller, sometimes called iDRAC, iLO or IPMI, that lets someone power the machine on remotely. It needs firmware updates and a strong password, and it should never face the internet. Hypervisors such as VMware or Hyper-V hosts have their own patch cycle, separate from the virtual machines running on them. Backup software, database engines and the operating system on the server itself each need their turn as well. Schedule server updates for a quiet evening, take a snapshot or backup first, and confirm afterwards that the line-of-business application, file shares and backups all came back cleanly.

Build it into a monthly checklist

A practical approach is one recurring hour each month: review vendor advisories, check the inventory against current versions, apply what is due and record what was done. Anything that cannot be updated because it is out of support goes onto a replacement list with a date. Over a year that simple habit removes the forgotten devices that turn small incidents into large ones.

Common traps to avoid

Several patterns cause trouble again and again. Automatic firmware updates are switched off on a network storage box because one update once caused a hiccup, and the device then sits three years out of date. A firewall support contract lapses, so updates stop arriving and nobody notices because the internet still works. A supplier installs remote support software on the reception computer for a single job and never removes it, leaving a door into the network with an unknown password.

Another trap is assuming the internet provider looks after the router it supplied. Some do, many do not, and a business-grade firewall you own is entirely your responsibility. Finally, beware of updating everything at once on a Friday afternoon. Stagger changes, keep configuration backups, and make sure someone is available to check that phones, printing and remote access still work afterwards. A little caution keeps patching from earning a bad reputation in the office.