Updates: why “I’ll do it later” is expensive

7 min read · DataRoad

The computer updates Postponements are today one of the cheapest ways for an attacker to get into a company. The direct answer: the security patches for the firewall, remote access, operating system, and browser must be applied in days, not months. The rest can — and should — follow a testing schedule. What cannot be done is to rely on someone “having time.”.

The “remember me later” button seems harmless. Multiply that by 40 computers, three servers, and a firewall that no one has updated since installation, and it’s an open door with a date stamped on it.

Why “later I’ll do it” is expensive

Verizon's 2026 data breach report brings three numbers that any administrator should know:

• 31% Of the breaches analyzed, the exploitation of a software flaw began—it became the most common entry point, ahead of the use of stolen credentials.
• Only 26% The critical flaws in the CISA (the US cybersecurity agency) list of exploited vulnerabilities were fully fixed in 2025.
• The average time to completely correct them has increased to 43 days (there were 32 in the previous year).

When a manufacturer releases a fix, they are also announcing to the world that that flaw exists. From that moment on, anyone who hasn't updated becomes a known target.

Example: how much does a day of downtime cost

Example (illustrative costs, not given by a client): a company with 30 employees loses its systems for one working day of 8 hours due to an attack that entered through a bug to be fixed. If the average cost of each hour of work is 20 euros, only the time lost costs 30 × 8 × 20 = 4,800 euros — before counting downtime billing, data recovery, hours of technicians and dissatisfied customers. The monthly maintenance window that would have prevented the problem costs a fraction of that.

What to update now — and what to expect

Not all updates are the same. The practical rule is to separate Security fixes (close gaps) by functionality updates (they bring news and changes).

What to expect (with discretion)

• Updates to the operating system functionality, until they are tested in a pilot group.
• New versions of the management software will be available until the provider confirms compatibility.
• Controllers and firmware without security patches.

“Waiting” is not “forgetting”: every exception has a date and a responsible person.

Who decides — and who executes

An update policy fits on a single page and answers four questions:

1. The administration approves the deadlines and the maintenance window. It is a risk-based decision, not a technical one.
2. The IT department is running and records: what was updated, when and with what result.
3. The software providers They confirm compatibility before major versions.
4. The users They restart when requested. A delayed restart is a correction to be applied.

This policy is part of a logic of preventative maintenanceIt is much cheaper to schedule than to react.

The maintenance window, specifically

Microsoft releases the monthly security patches for Windows on the second Tuesday of each month, and releases extraordinary patches when there is an exceptional need. This allows for a simple calendar:

• Week 1 after publication — corrections applied to a pilot group of 3 to 5 computers.
• Week 2 — if nothing went wrong, apply it to the rest of the company, outside of peak work hours.
• Staff — in a fixed monthly window, always with a verified backup first.
• Emergencies — flaws exploited in the firewall or VPN do not wait for a window: they are addressed on the same day.

And there are devices that no longer have fixes. Windows 10 will no longer receive support on October 14, 2025: if you still have it in your company, read on. what to do with the end of Windows 10 support. An updated inventory — like ours IT hardware audit checklist — is the starting point.

A real case: monitoring to avoid having to guess

A Boost Portugal, a tourism company with 12 brands and operations in Lisbon, Porto, Douro and Madrid, has an annual monthly advance contract with DataRoad that includes continuous monitoring of all its information systems, with remote monitoring, alarm management and availability reports. The contract also covers backups, the phone system, VPN management and internet redundancy with automatic switching to the second connection.

The lesson for the update topic is simple: don't update what you don't see. With monitored systems, you know what equipment exists, what version it is in, and which ones have been left behind. The difference between this approach and waiting for something to fail is explained in Proactive monitoring vs reactive support.

Frequently Asked Questions

The automatic updates aren't coming?

For the browser and office applications, they almost always arrive. For the firewall, VPN, and servers, they don't: they need someone to monitor the manufacturers' warnings, plan the intervention, and confirm that everything is back up and running.

And what if an update ruins something?

That is what the pilot group and the backup are for before upgrading servers. If something goes wrong, it only affects a few computers and there is a way to go back. The risk of not upgrading is usually much higher.

Why do firewall and VPN have maximum priority?

Because they are oriented towards the internet. Anyone in the world can try to connect to them, and the failures in these devices are automatically discovered shortly after they are published.

What do I do with computers that no longer receive updates?

Keep them isolated from the main network until they are replaced, and plan the replacement in order of risk: first those who access customer data, billing, or the internet without restrictions.

Report of overdue updates in 5 working days

We checked the firewall, remote access, servers and a sample of workstations, cross-checked known vulnerabilities and delivered the list of what to fix first. For companies with more than 10 workstations · support contract · remote, on-site and telephone support. Update management is part of the plans IT Unlimited — in Essential, the service is remote and telephone-based, and travel to the site is budgeted separately; in Premium, on-site assistance is included. Permanent monitoring is part of our service. Monitoring and NOC.

Sources

• Verizon — 2026 Data Breach Investigations Report, Executive Summary
• CISA — Known Exploited Vulnerabilities Catalog
• Microsoft Learn — Windows update release cycle
• Microsoft Learn — Windows 10 Lifecycle (End of Support on October 14, 2025)