TL;DR:

  • The majority of successful cyberattacks exploit known vulnerabilities — ones that already had a patch available when the attack happened
  • For small businesses, enabling automatic updates on operating systems, browsers, and critical apps is the most important first step
  • End-of-life software (Windows 10, unsupported PHP versions, old WordPress plugins) is a significant risk that many small businesses overlook

When security researchers analyse data breach investigations, a pattern shows up with uncomfortable regularity. The attacker didn’t find a clever zero-day. They used a vulnerability that had been publicly known and patchable for months — sometimes years. The victim’s systems just hadn’t been updated.

This isn’t a problem unique to large enterprises. It’s arguably worse for small businesses, where there’s no dedicated IT team tracking vulnerability disclosures and no automated patch management system enforcing updates across the estate. In a 10-person company, “we’ll sort the updates when we have time” is often how it works until it isn’t.

Here’s a practical approach that works without a sysadmin.

Why patching matters more than most security controls

Security budgets and attention get focused on the visible: antivirus software, firewalls, phishing training. These are all worthwhile. But unpatched software is consistently one of the top initial access vectors in successful attacks, according to the NCSC’s annual reports on cyber incidents affecting UK businesses.

The reason is straightforward. When a vulnerability in something like Windows, Apache, or a popular WordPress plugin gets patched, the patch itself is a public disclosure. Security researchers and attackers alike reverse-engineer the patch to understand exactly what was fixed. Within days there are working exploits. Businesses still running the vulnerable version are now exposed to attacks that essentially anyone can attempt — no special skill required.

Patching quickly — ideally within 14 days for critical vulnerabilities, faster for actively exploited ones — is the closest thing to guaranteed protection against this class of attack.

What to patch and in what order

Not all software carries the same risk. Prioritise based on exposure:

Internet-facing software first. Your web server, email server, VPN software, remote desktop tools, web applications, and cloud services. These are directly reachable by attackers and get targeted first. A vulnerability in your internal accounts package is serious; a vulnerability in your public-facing website or remote access software is more urgent.

Operating systems. Windows, macOS, and Linux all release regular security patches. These should be applied promptly — for critical patches, within a week if possible.

Browsers. Chrome, Edge, Firefox, and Safari update frequently and those updates often include security fixes for actively exploited vulnerabilities. Browsers should update automatically and you should confirm they are.

Business applications. Your accounting software, CRM, collaboration tools, and any other business software. Less frequently targeted than the above, but important.

Network devices. Routers, firewalls, managed switches. Often forgotten and often running firmware from years ago. Check the manufacturer’s site for the current version and how to update.

Turn on automatic updates — and verify they’re working

For most small businesses the right strategy is maximum automation. Turn on automatic updates for:

  • Windows: Settings > Windows Update > turn on “Receive updates for other Microsoft products” alongside OS updates
  • macOS: System Settings > General > Software Update > enable automatic updates
  • Google Chrome: updates automatically by default, restarts apply the update
  • Microsoft 365: managed through the Microsoft 365 admin centre — ensure automatic updates are enabled
  • WordPress (if you run one): WordPress core, plugins, and themes should all have automatic updates enabled unless you have a specific reason to manage them manually

The critical step most businesses skip: actually verifying that automatic updates are working. Enable them, then come back in a week and check that updates have been applied. Automation fails for various reasons — licence issues, disk space, service accounts not having permission — and you won’t know unless you look.

End-of-life software: the biggest overlooked risk

End-of-life software no longer receives security patches. Windows 10 reached end of life in October 2025. PHP 8.1 reached end of life in November 2024. Older versions of widely-used packages regularly cycle out of support.

Running end-of-life software means no matter how quickly you apply available patches, you’re running software that the vendor has stopped fixing. New vulnerabilities will be discovered and will remain unpatched forever.

For small businesses, the most common end-of-life risks are:

  • Old versions of Windows on PCs that “still work fine” — working fine isn’t the same as being secure
  • Outdated WordPress plugins and themes — check your installed plugins against the WordPress plugin directory; plugins that haven’t been updated in two years are often abandoned
  • Old PHP versions on hosting accounts — your web host’s control panel usually shows the PHP version; anything below 8.2 is approaching or past end of life

Upgrading from end-of-life software to supported versions is more disruptive than a regular update, but it’s not optional from a security standpoint.

Keeping a simple inventory

You can’t patch what you don’t know about. A basic software inventory doesn’t have to be sophisticated — a spreadsheet listing devices, their operating systems, and key installed applications is enough for a small business. Update it when new devices or software are added.

For five or more Windows devices, Windows Update for Business (available with Microsoft 365 Business Premium) provides centralised patch management and reporting. It lets you see at a glance whether all devices are current without logging into each one.

The Cyber Essentials certification — which is worth considering if you deal with larger clients or public sector contracts — specifically requires that software is kept up to date and that unsupported software is removed. Passing CE gives you a documented, externally verified baseline.

A consistent update habit is boring. It rarely comes with a dramatic “we blocked an attack” moment. What it does is quietly eliminate a large category of risk, month after month, without much effort once the process is set up.