Software updates for small teams

We end up explaining this on discovery calls often enough that it deserved writing down. Most advice about software updates assumes a team that does not exist at your size. Here is the version that does not.

Security is a maintenance habit rather than a purchase, which is why it drifts. It is the sort of thing that looks like polish right up until it costs you an enquiry.

What to keep

Most breaches exploit a fix that already existed. That sounds obvious written down. It is still the thing most often skipped. Assume whoever inherits this will have half your context and none of your patience.

What to drop

Process that exists to coordinate ten people is overhead when there are two of you. None of that requires a large budget, only a decision and someone to own it.

Where to start

Staging first prevents the update becoming the outage. This is the sort of thing that compounds, quietly, in both directions. Budget a little time for it every quarter and it never becomes a project of its own.

What this looks like day to day

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about software updates before you move on:

• Someone can say what the current setup is without going to look
• Staging first prevents the update becoming the outage — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.