---
title: "Software updates: the real cost of putting off patches"
description: "31% of data breaches start with an unpatched software flaw. Deadlines per component, who approves and the monthly schedule. No-obligation proposal."
language: en
url: https://www.dataroad-it.com/en/patch-management-cost-of-delay/
source: https://www.dataroad-it.com/en/patch-management-cost-of-delay/
publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal
---

> 31% of data breaches start with an unpatched software flaw. Deadlines per component, who approves and the monthly schedule. No-obligation proposal.

# Software updates: the real cost of putting off patches

At a glance For decision-makers short on time.

- 01 31% of the breaches analysed by Verizon in 2026 began with a software flaw.
- 02 Firewall, VPN, operating system and browser: fixes in days, not months.
- 03 Monthly window: a pilot of 3 to 5 workstations, then the fleet; servers always backed up first.
- 04 A day of downtime across 30 workstations costs €4,800 in lost time alone (illustrative example).

### In this article

Unapplied software fixes have become attackers' favourite way in, and closing them costs far less than a day with the company at a standstill. The rule we apply to the fleets we manage is simple: firewall, remote access, operating system and browser are patched within days; everything else follows a monthly schedule, tested beforehand. What must not happen is the decision waiting until someone “has time”.

Clicking “remind me later” seems harmless on one computer. Added up across 40 workstations, three servers and a firewall nobody has touched since it was installed, it becomes a vulnerability with a date attached.

## How much does postponing cost, in figures?

Verizon's 2026 data breach report leaves three indicators every board should know:

- **31%** The share of breaches analysed that began with the exploitation of a software flaw. It is now the most frequent entry point, ahead of stolen credentials.
- **26%** The proportion of critical flaws in the known exploited vulnerabilities catalogue of CISA, the US cybersecurity agency, that were fully patched in 2025.
- **43 days** The median time to complete those fixes, against 32 the year before. Attackers do not wait that long.

Every fix a manufacturer publishes is also a public announcement that the flaw exists. From then on, anyone who has not updated is an identified target.

**For decision-makers:** the CISA catalogue is, in practice, the list of locks that burglars already know how to open. The agency itself recommends that every organisation follows it and fixes what is listed there first. A company device on that list is a matter for this week, not next quarter.

### Simulation: the price of a day without systems

Illustrative assumptions, not client data: 30 workstations idle for an 8-hour working day after an attack that came in through a known flaw, at an average cost of €20 per working hour. In lost time alone that is 30 × 8 × 20 = **€4,800**, without counting interrupted invoicing, data recovery, technical hours and unhappy clients. A monthly maintenance window costs a fraction of that.

## What deadline should each type of update have?

The distinction that matters is between **security fixes**, which close flaws, and **feature updates**, which change how programs behave.

| Component | Examples | Recommended deadline | Reason |
| --- | --- | --- | --- |
| Firewall and VPN | Firmware, remote access portal | Days: hours, if the flaw is already being exploited | Visible from the internet; they are attacked first |
| Operating system | Monthly Windows and macOS fixes | Within two weeks of publication | The flaw becomes public on the day of the fix |
| Browser | Chrome, Edge, Safari | Automatic, with mandatory restart | Concentrates daily work and most phishing |
| Office applications | Microsoft 365, PDF readers | Automatic | Favourite target of malicious attachments |
| Servers | File servers, management software | Monthly window, with prior backup | Critical to operations; changed according to plan |
| Version upgrades | New Windows, new ERP version | Planned, after testing | May change processes and require validation |

These can wait, with judgement: operating system feature updates until they have passed a pilot group, new versions of management software until the supplier confirms compatibility, and drivers or firmware with no security component. Waiting is not forgetting: every exception has a date and an owner.

## Who approves and who carries it out?

The policy fits on one page and sets four roles:

- **Board**: approves deadlines and the maintenance window. It is a risk management decision, not a technical detail.
- **IT team or managed partner**: applies the fixes and records what, when and with what result.
- **Software suppliers**: validate compatibility before version upgrades.
- **Users**: restart when asked; a postponed restart is a fix that has not been applied.

This is the logic of [preventive versus corrective maintenance](https://www.dataroad-it.com/en/managed-it-vs-break-fix-sme-costs/): scheduling always costs less than reacting.

## What does the monthly calendar look like?

Microsoft publishes Windows security fixes on the second Tuesday of each month and releases out-of-band fixes when the situation requires it. The result is a predictable cycle:

- **First week** Deployment to a pilot group of 3 to 5 computers.
- **Second week** If the pilot raises no problems, deployment to the rest of the fleet, outside peak hours.
- **Servers** A fixed monthly window, always after confirming the backup.
- **Emergencies** Exploited flaws in the firewall or VPN are dealt with the same day, without waiting for the window.

There are also devices that no longer receive fixes: Windows 10 lost support on 14 October 2025. If it is still in the company, see [how to deal with Windows 10 workstations](https://www.dataroad-it.com/en/windows-10-end-of-support-migration-plan/). The starting point is a reliable inventory, such as the one in the [checklist for auditing the IT estate](https://www.dataroad-it.com/en/it-estate-audit-checklist-8-blocks/).

## Why does monitoring come before updating?

Because you cannot fix what you cannot see. [Boost Portugal](https://www.dataroad-it.com/en/boost-portugal-redundant-internet-managed-it/) (12 tourism brands operating in Lisbon, Porto, the Douro and Madrid) has an annual contract with DataRoad on a monthly fee, with continuous monitoring of all its information systems: remote oversight, alerting and availability reports. The same contract covers backups, the phone system, VPN management and internet redundancy with automatic failover to the second connection.

With everything monitored, the company knows which devices it has, which version each one runs and which have fallen behind. The difference from waiting for a failure is set out in [proactive monitoring and reactive support, side by side](https://www.dataroad-it.com/en/noc-proactive-monitoring-vs-reactive/).

## Frequently asked questions

### Is it enough to switch on automatic updates?

Not for the firewall, VPN and servers. For the browser and office applications, automatic updates almost always do the job; critical devices need someone to follow manufacturers' advisories, plan the intervention and confirm that everything is back to normal.

### What if an update breaks something?

That is what the pilot group and the prior backup are for: the failure is confined to a few workstations and there is a way to roll back. The risk of not updating is almost always considerably greater.

### Why do the firewall and VPN come first?

Because they are exposed to the internet. Anyone can try to connect to them, and flaws in these devices are scanned for automatically shortly after they are disclosed.

### What should be done with computers that no longer receive fixes?

Separate them from the main network until they are replaced, and replace the highest-risk ones first: those that handle client data, invoicing or unrestricted internet access.

## Next step: overdue fixes report in 5 working days

DataRoad - IT Services and Consulting analyses the firewall, remote access, servers and a sample of workstations, cross-checks the results against known flaws and delivers a list of priorities. In 11 years, DataRoad has never suffered a security incident.

Update management is included in the [IT Unlimited](https://www.dataroad-it.com/en/managed-it-services/) plans: Essential (from €395/month + VAT) is remote and telephone support; Premium (from €750/month + VAT) adds unlimited on-site support, with call-outs included. Continuous oversight is part of the [NOC and monitoring](https://www.dataroad-it.com/en/noc-it-monitoring-portugal/) service.

Request a no-commitment proposal: **+351 211 459 950 *** · sales@dataroad.pt. More than 10 workstations · support contract · remote, on-site and telephone support.

**Call to a Portuguese landline.*

## Sources consulted

- [Verizon: DBIR 2026 executive summary](https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf)
- [CISA: known exploited vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities)
- [Microsoft Learn: Windows update release cycle](https://learn.microsoft.com/en-us/windows/deployment/update/release-cycle)
- [Microsoft Learn: Windows 10 lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro)

Chosen by respected and international companies

★★★★★ 5,0 · 52 Google reviews

★★★★★ 5,0 · 52 Google reviews

DataRoad

## Related articles

[Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/)

Numbers you can verify

**11** years in business

**232** clients

**< 10 min** average response time

**15+** IT vendor certifications

**10+** Countries with clients supported

**5.0 ★** 52 Google reviews

Transparency

## What many providers hide, we publish.

[See plans and prices →](https://www.dataroad-it.com/it-unlimited/)

- **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200.
- **No lock-in** Annual contract, no lock-in and no joining fees.
- **Everything in writing** What is included, the scope and the price, before you sign.
- **Support without counted hours** Remote and phone in every plan; on-site support from Premium.

Partners and certifications

DataRoad · IT Unlimited

## One StepAhead of IT.

Predictability is a service: the same fee every month, requests without counting hours and an SLA written into the contract.

- **232** clients under management
- **1** contract and one owner for everything
- **5 ★** on Google · 52 reviews

We do **IT** right.

DataRoad IT Unlimited

## Have your backups ever been put to the test?

Automated, monitored backups stored off site.

[Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente)

---
Versão HTML desta página: https://www.dataroad-it.com/en/patch-management-cost-of-delay/