Three myths about software updates

It comes up on almost every project, usually later than it should. A few things about software updates that get repeated more often than they get checked.

Security is a maintenance habit rather than a purchase, which is why it drifts. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

“It only matters for big sites”

Most breaches exploit a fix that already existed. It is worth being explicit about, because assumptions differ quietly. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

“We can deal with it after launch”

Sometimes true, usually expensive. The cost of getting this wrong is rarely visible on the day it happens.

“Our platform handles it”

Staging first prevents the update becoming the outage. None of that requires a large budget, only a decision and someone to own it. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

What this looks like day to day

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about software updates before you move on:

• Someone can say what the current setup is without going to look
• Most breaches exploit a fix that already existed — and you know whether that is true here
• There is a way to tell whether the last change to this helped

None of this needs a rewrite. Most of it is a morning's work once someone decides to do it.