Why software updates matters more than it looks

Every audit we run turns up some version of this. Software updates is easy to treat as a detail, and that is exactly why it is worth a few minutes of attention.

The cheapest security work is the boring kind done on a schedule. It rarely shows up as a line item, which is exactly why it slips.

The reason this keeps coming up

Most breaches exploit a fix that already existed. None of that requires a large budget, only a decision and someone to own it. Budget a little time for it every quarter and it never becomes a project of its own.

Schedule updates rather than reacting to incidents. Where this goes wrong is almost never a lack of knowledge. It rarely shows up as a line item, which is exactly why it slips.

What to watch for

Staging first prevents the update becoming the outage. The teams that handle this well are rarely the ones with the biggest budgets. Doing this properly once is usually cheaper than doing it approximately three times.

What this looks like day to day

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about software updates before you move on:

• Someone can say what the current setup is without going to look
• Most breaches exploit a fix that already existed — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.