Why keeping your computers patched matters, and how to do it

What a patch actually does

Every large piece of software contains mistakes. Some of those mistakes let an attacker run code, read memory or bypass a login. When a vendor finds or is told about one, it releases a fix and usually publishes a short description of the problem. That description is a map: criminals compare the old and new versions, work out the weakness and build tools to exploit it.

So the time between a patch being released and attacks starting is often short. For widely used products such as Windows, Chrome, Microsoft Office, Adobe Reader and firewall operating systems, mass scanning can begin within days. The computers that get caught are the ones still waiting for a restart nobody got round to.

Why updates get skipped in small offices

The reasons are ordinary. Someone clicks Remind me later for three weeks. A laptop lives in a bag and is only switched on for meetings. An old accounting add-in breaks after an update, so somebody turns updates off to avoid it happening again. Nobody owns the job, and nobody checks. Each skipped update is small on its own. Across ten or twenty computers, over six months, you end up with a mix of versions and a handful of machines that are badly behind. Those machines are where incidents start.

A routine that works

Pick a predictable rhythm. Microsoft releases most security updates on the second Tuesday of each month, which in New Zealand lands on the Wednesday. A sensible plan is to approve updates for a small test group of two or three computers first, then the rest of the office a few days later, with a deadline that forces a restart outside work hours.

Critical fixes for something being actively exploited should jump the queue and go out within a day or two. Use a management tool such as Microsoft Intune or a remote monitoring platform so updates are pushed, not left to each person, and so you can see a report of which devices are behind.

Do not stop at Windows

Browsers, PDF readers, Java, Zoom, remote access tools and line-of-business software all need updating too, and many of them are not handled by Windows Update. Macs need macOS and app updates on a similar schedule. Phones and tablets that access company email should be on a supported operating system version.

Then there is equipment people forget: the firewall, the Wi-Fi access points, network storage boxes, printers and the server's own management card. In many offices these have not been touched since the day they were installed, and some are still running the firmware they shipped with. These devices often face the internet or sit in the middle of your network. Check for firmware updates monthly and apply security fixes promptly.

Check, do not assume

A patching routine is only as good as its reporting. Each month, someone should look at a list of devices that missed updates or have not checked in for a fortnight and chase them. A laptop that has been off for six weeks will need a catch-up session before it goes back into normal use. Watch too for updates that report as installed but are waiting on a restart; on paper the device looks fine, but the fix is not active until the computer reboots.

Finally, plan for retirement. When software or hardware reaches end of support, the vendor stops releasing fixes entirely. Keep a short register of what is approaching that point, so replacement is budgeted rather than discovered during an incident. Windows versions, Office releases, servers and firewalls all have published end-of-support dates worth noting in a calendar.

Who should own it

Patching fails most often because it is everybody's job and therefore nobody's. In a small office, name one person, internal or external, as responsible for the monthly cycle, the exceptions and the report. That person does not have to install every update by hand; the tools do most of the work. Their job is to notice when the tools have not, and to follow up with the laptop owner who keeps postponing a restart or the supplier whose software blocks an upgrade.

If you use a managed IT provider, ask to see the patch report rather than taking it on trust. A good report lists every device, its last update date and any failures, with a short note on what is being done about each. If the provider cannot show you that list, the patching may not be happening the way you think it is, and that is worth finding out before an attacker does.