Software updates: what to get right first

It is rarely the thing that gets a project approved, and often the thing that decides how it goes. If you only fix one thing about software updates this quarter, make it the first item below.

The cheapest security work is the boring kind done on a schedule. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

Start here

Most breaches exploit a fix that already existed. The cost of getting this wrong is rarely visible on the day it happens. If it only works because one person remembers to do something, it does not work yet.

Then this

Schedule updates rather than reacting to incidents. Getting it slightly wrong is survivable. Ignoring it entirely is not. If two people in the business would answer this differently, that gap is the actual problem.

Eventually

Staging first prevents the update becoming the outage. There is a version of this that is over-engineered, and it is worth avoiding. It is the sort of thing that looks like polish right up until it costs you an enquiry.

The short version

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about software updates before you move on:

• Someone can say what the current setup is without going to look
• Staging first prevents the update becoming the outage — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.