Patch Management for Small Businesses: A Plain-English Guide

Every month, Microsoft, Apple, Google and the makers of almost every program you use release updates. Some add features, but many fix security weaknesses that criminals already know about. Once a fix is published, attackers can study it to work out exactly which weakness it closes, then go looking for businesses that haven’t installed it yet.

Patch management is simply making sure those updates (patches) are installed on every device, quickly and reliably. It sounds basic, and it is. But it’s also one of the things small businesses most often get wrong, because “updates are switched on” isn’t the same as “updates have actually happened”.

What needs updating?

It’s more than just Windows. A proper approach covers:

• Operating systems: Windows and macOS on every computer and laptop, plus phones and tablets used for work.
• Applications: Microsoft 365 apps, web browsers, PDF readers, accounts software and anything else installed.
• Internet-facing equipment: your router, firewall and Wi-Fi equipment. These are often forgotten for years.
• Servers and network storage, if you still have them in the office.
• Specialist software: practice management, design or industry-specific programs, which often update separately.

How quickly should updates go on?

For businesses following Cyber Essentials, the UK Government-backed security scheme, the rule is clear: updates that fix critical or high-risk weaknesses must be installed within 14 days of release. That applies to operating systems, applications and router or firewall firmware. If you can’t meet it for something, that’s an automatic fail.

Even if you’re not certified, 14 days is a sensible target for important security updates. For the most serious ones, the kind that make the news, sooner is better.

Software that’s no longer supported, such as Windows 10 without paid extended updates, doesn’t get security fixes at all, so it can’t be “patched”. It needs replacing or upgrading. We covered this in Windows 10 end of life: why businesses must act now.

Why updates don’t happen, even when they’re “switched on”

These are the gaps we find most often in IT audits:

• The laptop that’s never restarted. Many updates only finish after a restart. A laptop that’s just closed and opened for months can be weeks behind.
• Devices that are rarely in the office. Home and travelling laptops miss updates that depend on being on the office network.
• Apps nobody looks after. Windows updates itself, but the PDF reader, accounts package or design program may not.
• The router. Installed by the internet provider years ago and never looked at since.
• Updates that failed quietly. An update tried, failed, and nobody noticed.
• “We’ll do it next week.” Updates postponed because someone is busy, and then forgotten.

What good patch management looks like

You don’t need to be technical to know whether it’s being done properly. Good patch management has five parts:

1. An up-to-date list of devices and software. You can’t update what you don’t know about.
2. Automatic updates, centrally managed. Updates are pushed out from one place, not left to each person to accept.
3. Sensible timing. Updates install outside working hours where possible, with a deadline so restarts actually happen.
4. Checking and reporting. Someone checks that updates really did install on every device and chases the ones that didn’t.
5. A plan for the exceptions. If something can’t be updated straight away (say, a specialist program that breaks with a new version), that’s written down with a date and a workaround.

The tools that help

For a small business, the main options are:

• Microsoft Intune, included in Microsoft 365 Business Premium. It manages Windows updates and many apps on company laptops, wherever they are.
• Remote monitoring and management (RMM) tools, used by IT support companies. They check every device, install updates for Windows and common apps, and report anything that’s fallen behind.
• The router or firewall’s own update settings, which should be checked and, where possible, set to update automatically.

The tool matters less than the routine. The most important question is: who checks, and how often?

Questions to ask your IT provider

If someone looks after your IT, ask them:

• Can you show me a report of which devices are fully up to date right now?
• How quickly do critical security updates go on?
• Do you update apps as well as Windows?
• When were our router and firewall last updated?
• What happens with laptops that are rarely in the office?

If the answers are vague, it’s worth a closer look. Our article on why updating Windows matters even when it isn’t broken explains the risk in more detail.

Need a hand?

Updates are part of our managed IT support: every computer is monitored around the clock, and Windows and common apps are updated automatically and checked, so you’re not relying on anyone remembering to restart. We also help businesses get Cyber Essentials certified. Book a free call and we’ll start with a free IT audit to show you exactly how up to date your devices really are.