PROTECT · UPDATES & PATCHING
Updates & Patching — Are Known Weaknesses Being Fixed?
When a security weakness becomes known, an update may be what closes it. The business needs confidence that important systems are actually receiving those fixes.
Why software needs updating
Software contains mistakes. Some are ordinary bugs; others create security weaknesses that can be exploited. Vendors release updates to improve products and fix problems.
Once a weakness is known publicly, leaving an affected system unpatched can give attackers an opportunity that already has a known solution.
Automatic updates are useful — but know the exceptions
For many everyday devices and applications, automatic updating can remove unnecessary manual work. But businesses often have exceptions: specialist software, old devices, unsupported systems or applications where an update needs testing first.
The important thing is knowing where those exceptions are and who owns the decision.
Unsupported technology creates a different problem
If a product no longer receives security updates, waiting for the next patch is not a plan. The business may need to replace it, isolate it, reduce its exposure or accept the risk temporarily while a controlled change is made.
That decision should be visible rather than discovered after an incident.
Focus first on important and exposed systems
Internet-facing services, browsers, operating systems, remote-access tools and applications handling important information deserve particular attention. Your IT provider may operate the process, but the business should be able to obtain evidence that it is happening.
BOI ACTION
Check one device you use for important business work.
Confirm whether automatic updates are enabled, whether updates are currently pending and whether the operating system or application is still supported by its vendor.
If somebody else manages it, ask them how they know important updates are being applied.
A useful question for the business
Which important system would worry us most if we discovered it had missed security updates for six months?
Don’t assume. Check.
“Updates are automatic” is useful only when you know which systems that statement covers. Check the exceptions.
NOT SURE WHERE TO START?
Take the 15-Minute Business Security Check
Use ten questions to identify three priorities for sensible action.
Useful guidance
Final publication QA will verify current UK-first software-update and vulnerability-management guidance and supporting authoritative sources.
Continue exploring
Technical controls reduce opportunities, but some attacks target business processes instead.
Explore the Cyber Security Guides →
Found something that may be outdated or incorrect? Let us know.
Better Decisions. Stronger Organisations.
Understand what matters. Take sensible action. Check whether it worked.
