Software updates: the real cost of putting off patches

Verizon's 2026 data breach report leaves three indicators every board should know:

• 31% The share of breaches analysed that began with the exploitation of a software flaw. It is now the most frequent entry point, ahead of stolen credentials.
• 26% The proportion of critical flaws in the known exploited vulnerabilities catalogue of CISA, the US cybersecurity agency, that were fully patched in 2025.
• 43 days The median time to complete those fixes, against 32 the year before. Attackers do not wait that long.

Every fix a manufacturer publishes is also a public announcement that the flaw exists. From then on, anyone who has not updated is an identified target.

For decision-makers: the CISA catalogue is, in practice, the list of locks that burglars already know how to open. The agency itself recommends that every organisation follows it and fixes what is listed there first. A company device on that list is a matter for this week, not next quarter.

Simulation: the price of a day without systems

Illustrative assumptions, not client data: 30 workstations idle for an 8-hour working day after an attack that came in through a known flaw, at an average cost of €20 per working hour. In lost time alone that is 30 × 8 × 20 = €4,800, without counting interrupted invoicing, data recovery, technical hours and unhappy clients. A monthly maintenance window costs a fraction of that.

The distinction that matters is between security fixes, which close flaws, and feature updates, which change how programs behave.

These can wait, with judgement: operating system feature updates until they have passed a pilot group, new versions of management software until the supplier confirms compatibility, and drivers or firmware with no security component. Waiting is not forgetting: every exception has a date and an owner.

The policy fits on one page and sets four roles:

1. Board: approves deadlines and the maintenance window. It is a risk management decision, not a technical detail.
2. IT team or managed partner: applies the fixes and records what, when and with what result.
3. Software suppliers: validate compatibility before version upgrades.
4. Users: restart when asked; a postponed restart is a fix that has not been applied.

This is the logic of preventive versus corrective maintenance: scheduling always costs less than reacting.

Microsoft publishes Windows security fixes on the second Tuesday of each month and releases out-of-band fixes when the situation requires it. The result is a predictable cycle:

• First week Deployment to a pilot group of 3 to 5 computers.
• Second week If the pilot raises no problems, deployment to the rest of the fleet, outside peak hours.
• Servers A fixed monthly window, always after confirming the backup.
• Emergencies Exploited flaws in the firewall or VPN are dealt with the same day, without waiting for the window.

There are also devices that no longer receive fixes: Windows 10 lost support on 14 October 2025. If it is still in the company, see how to deal with Windows 10 workstations. The starting point is a reliable inventory, such as the one in the checklist for auditing the IT estate.

Because you cannot fix what you cannot see. Boost Portugal (12 tourism brands operating in Lisbon, Porto, the Douro and Madrid) has an annual contract with DataRoad on a monthly fee, with continuous monitoring of all its information systems: remote oversight, alerting and availability reports. The same contract covers backups, the phone system, VPN management and internet redundancy with automatic failover to the second connection.

With everything monitored, the company knows which devices it has, which version each one runs and which have fallen behind. The difference from waiting for a failure is set out in proactive monitoring and reactive support, side by side.

DataRoad - IT Services and Consulting analyses the firewall, remote access, servers and a sample of workstations, cross-checks the results against known flaws and delivers a list of priorities. In 11 years, DataRoad has never suffered a security incident.

Update management is included in the IT Unlimited plans: Essential (from €395/month + VAT) is remote and telephone support; Premium (from €750/month + VAT) adds unlimited on-site support, with call-outs included. Continuous oversight is part of the NOC and monitoring service.

Request a no-commitment proposal: +351 211 459 950 * · sales@dataroad.pt. More than 10 workstations · support contract · remote, on-site and telephone support.

*Call to a Portuguese landline.

• Verizon: DBIR 2026 executive summary
• CISA: known exploited vulnerabilities catalogue
• Microsoft Learn: Windows update release cycle
• Microsoft Learn: Windows 10 lifecycle