Why is keeping systems up to date a security measure?

The message asking you to restart your computer and install updates tends to be postponed again and again. It looks like a maintenance chore with no direct link to security. Yet many updates exist precisely to fix flaws that would let an attacker break into the system. Putting off the installation means leaving open a vulnerability that is already public.

What a security update fixes

All software has bugs. Some are merely annoying; others allow someone to run code on the computer, gain access to data or take over an account. When a manufacturer discovers or is told about a flaw of this kind, it develops a fix and distributes it as an update.

The delicate point is that, once the fix is published, the flaw is no longer a secret. Attackers analyse updates to understand what has been fixed and start looking for systems that have not yet been updated. The interval between publication and installation is the period of greatest exposure.

What Cyber Essentials requires

The UK scheme treats security update management as one of its five technical controls and sets clear criteria:

14-day deadline: updates rated critical or high risk must be applied within 14 days of release. The benchmark is a CVSS v3 score of 7 or above, or the manufacturer's own rating of critical or high.
Supported software: systems and applications must be licensed and supported by the manufacturer.
Unsupported software: must be removed or isolated, so that it is not reachable from the internet or from the main network.

These criteria apply to operating systems, browsers, office applications, router and firewall firmware, mobile phones used for work and any other software that connects to the internet.

The problem with unsupported software

When a manufacturer ends support for a version, it stops publishing fixes. From then on, any flaw discovered remains open indefinitely. It is common to find computers in small businesses running old versions of the operating system, kept because they run a specific program that was never migrated.

In such cases, there are a few options:

Upgrade to a supported version, if the system allows it.
Replace the equipment or the software.
Isolate the device, removing its internet access and separating it from the network where the other computers sit.

Keeping the equipment as it is, connected as normal, is the option that concentrates the most risk.

In practice: the biggest gain usually comes from turning on automatic updates wherever possible. Operating systems, browsers and most modern applications offer this option. Manual effort is then reserved for what does not update itself, such as routers, servers and specialist systems.

How to organise updates in an SME

You do not need a sophisticated tool to get started. A few practices solve most of the problem:

Inventory: knowing which devices and software exist is the foundation. You cannot update what you do not know about.
Automatic updates: turn them on for computers, mobile phones and browsers.
Maintenance window: set a regular slot, for example weekly, for restarts and checks, reducing the impact on work.
Watch what gets forgotten: routers, network printers, cameras and servers often go years without updates.
Follow-up with your IT provider: if IT is outsourced, it is worth asking for a periodic report of devices with pending updates.

In some cases, an update can cause an incompatibility with an internal system. That justifies testing it first on one machine, but it does not justify postponing it indefinitely. The 14-day deadline is a good benchmark for balancing caution and exposure.

Updates as part of a wider set

Keeping systems up to date does not prevent every attack. Social engineering scams, leaked passwords and inadequate configurations remain possible. That is why updates work best alongside the other controls, as described in the five basic cyber security controls, and a good backup plan, the subject of backups against ransomware.

Checklist

Automatic updates enabled on computers, mobile phones and browsers.
Critical and high-risk updates applied within 14 days.
No unsupported software in normal use, or isolated where unavoidable.
Firmware on routers, firewalls and other network equipment checked periodically.
A named person responsible for tracking pending updates.