In this article
Unapplied software fixes have become attackers' favourite way in, and closing them costs far less than a day with the company at a standstill. The rule we apply to the fleets we manage is simple: firewall, remote access, operating system and browser are patched within days; everything else follows a monthly schedule, tested beforehand. What must not happen is the decision waiting until someone “has time”.
Clicking “remind me later” seems harmless on one computer. Added up across 40 workstations, three servers and a firewall nobody has touched since it was installed, it becomes a vulnerability with a date attached.
How much does postponing cost, in figures?
Verizon's 2026 data breach report leaves three indicators every board should know:
- 31% The share of breaches analysed that began with the exploitation of a software flaw. It is now the most frequent entry point, ahead of stolen credentials.
- 26% The proportion of critical flaws in the known exploited vulnerabilities catalogue of CISA, the US cybersecurity agency, that were fully patched in 2025.
- 43 days The median time to complete those fixes, against 32 the year before. Attackers do not wait that long.
Every fix a manufacturer publishes is also a public announcement that the flaw exists. From then on, anyone who has not updated is an identified target.
For decision-makers: the CISA catalogue is, in practice, the list of locks that burglars already know how to open. The agency itself recommends that every organisation follows it and fixes what is listed there first. A company device on that list is a matter for this week, not next quarter.
Simulation: the price of a day without systems
Illustrative assumptions, not client data: 30 workstations idle for an 8-hour working day after an attack that came in through a known flaw, at an average cost of €20 per working hour. In lost time alone that is 30 × 8 × 20 = €4,800, without counting interrupted invoicing, data recovery, technical hours and unhappy clients. A monthly maintenance window costs a fraction of that.
What deadline should each type of update have?
The distinction that matters is between security fixes, which close flaws, and feature updates, which change how programs behave.
| Component | Examples | Recommended deadline | Reason |
|---|---|---|---|
| Firewall and VPN | Firmware, remote access portal | Days — hours, if the flaw is already being exploited | Visible from the internet; they are attacked first |
| Operating system | Monthly Windows and macOS fixes | Within two weeks of publication | The flaw becomes public on the day of the fix |
| Browser | Chrome, Edge, Safari | Automatic, with mandatory restart | Concentrates daily work and most phishing |
| Office applications | Microsoft 365, PDF readers | Automatic | Favourite target of malicious attachments |
| Servers | File servers, management software | Monthly window, with prior backup | Critical to operations; changed according to plan |
| Version upgrades | New Windows, new ERP version | Planned, after testing | May change processes and require validation |
These can wait, with judgement: operating system feature updates until they have passed a pilot group, new versions of management software until the supplier confirms compatibility, and drivers or firmware with no security component. Waiting is not forgetting — every exception has a date and an owner.
Who approves and who carries it out?
The policy fits on one page and sets four roles:
- Board — approves deadlines and the maintenance window. It is a risk management decision, not a technical detail.
- IT team or managed partner — applies the fixes and records what, when and with what result.
- Software suppliers — validate compatibility before version upgrades.
- Users — restart when asked; a postponed restart is a fix that has not been applied.
This is the logic of preventive versus corrective maintenance: scheduling always costs less than reacting.
What does the monthly calendar look like?
Microsoft publishes Windows security fixes on the second Tuesday of each month and releases out-of-band fixes when the situation requires it. The result is a predictable cycle:
- First week Deployment to a pilot group of 3 to 5 computers.
- Second week If the pilot raises no problems, deployment to the rest of the fleet, outside peak hours.
- Servers A fixed monthly window, always after confirming the backup.
- Emergencies Exploited flaws in the firewall or VPN are dealt with the same day, without waiting for the window.
There are also devices that no longer receive fixes: Windows 10 lost support on 14 October 2025. If it is still in the company, see how to deal with Windows 10 workstations. The starting point is a reliable inventory, such as the one in the checklist for auditing the IT estate.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Why does monitoring come before updating?
Because you cannot fix what you cannot see. Boost Portugal — 12 tourism brands operating in Lisbon, Porto, the Douro and Madrid — has an annual contract with DataRoad on a monthly fee, with continuous monitoring of all its information systems: remote oversight, alerting and availability reports. The same contract covers backups, the phone system, VPN management and internet redundancy with automatic failover to the second connection.
With everything monitored, the company knows which devices it has, which version each one runs and which have fallen behind. The difference from waiting for a failure is set out in proactive monitoring and reactive support, side by side.
Frequently asked questions
Is it enough to switch on automatic updates?
Not for the firewall, VPN and servers. For the browser and office applications, automatic updates almost always do the job; critical devices need someone to follow manufacturers' advisories, plan the intervention and confirm that everything is back to normal.
What if an update breaks something?
That is what the pilot group and the prior backup are for: the failure is confined to a few workstations and there is a way to roll back. The risk of not updating is almost always considerably greater.
Why do the firewall and VPN come first?
Because they are exposed to the internet. Anyone can try to connect to them, and flaws in these devices are scanned for automatically shortly after they are disclosed.
What should be done with computers that no longer receive fixes?
Separate them from the main network until they are replaced, and replace the highest-risk ones first: those that handle client data, invoicing or unrestricted internet access.
Next step: overdue fixes report in 5 working days
DataRoad - IT Services and Consulting analyses the firewall, remote access, servers and a sample of workstations, cross-checks the results against known flaws and delivers a list of priorities. In 11 years, DataRoad has never suffered a security incident.
Update management is included in the IT Unlimited plans: Essential (from €395/month + VAT) is remote and telephone support; Premium (from €750/month + VAT) adds unlimited on-site support, with call-outs included. Continuous oversight is part of the NOC and monitoring service.
Request a no-commitment proposal: +351 211 459 950* · sales@dataroad.pt. More than 10 workstations · support contract · remote, on-site and telephone support.
*Call to a Portuguese landline.
