When software updates is worth the effort

We end up explaining this on discovery calls often enough that it deserved writing down. Software updates is not free, and pretending otherwise leads to bad decisions.

Security is a maintenance habit rather than a purchase, which is why it drifts. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

When it is worth it

Most breaches exploit a fix that already existed. That sounds obvious written down. It is still the thing most often skipped. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

When it is not

If nothing downstream depends on it and nobody is complaining, it can wait. In practice this is a scheduling problem more than a technical one.

How to decide

Staging first prevents the update becoming the outage. There is a version of this that is over-engineered, and it is worth avoiding. Doing this properly once is usually cheaper than doing it approximately three times.

The short version

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about software updates before you move on:

• Someone can say what the current setup is without going to look
• Most breaches exploit a fix that already existed — and you know whether that is true here
• There is a way to tell whether the last change to this helped

The point is not perfection, it is knowing which of these you have consciously chosen to skip.