Patch Management for Small Business: A Routine That Sticks

Why patching matters more than antivirus

An update fixes a known weakness. Once a fix is published, attackers can study it and target everyone who has not installed it yet. CSA's Update your software promptly campaign puts it simply: install updates for operating systems, browsers, plug-ins, antivirus and other apps as soon as they are available.

Antivirus helps catch what slips through. Patching closes the door in the first place, and it is free.

The US agency CISA keeps a public Known Exploited Vulnerabilities catalog of weaknesses that attackers are actively using. If a product you run appears there, treat its update as urgent rather than waiting for the monthly check.

What to update: the list people forget

Laptops and phones are the easy part. The devices that get exploited are usually the ones nobody looks at.

For cloud services (SaaS), the vendor patches the software. CSA's Cyber Essentials standard says you should still confirm what the provider is responsible for under its shared responsibility model.

Set up automatic updates on every device

Do this once. After that, most updates happen without anyone thinking about it.

1. 1

   Windows: set updates to automatic and set active hours

   In Settings, Windows Update, keep updates on and set active hours so restarts happen outside work. Microsoft's release cycle page confirms the monthly security update lands on the second Tuesday.

2. 2

   Mac: turn on automatic macOS and security updates

   In System Settings, General, Software Update, switch on automatic updates, including security responses and system files.

3. 3

   Phones: auto-download over Wi-Fi

   On iPhone, turn on Automatic Updates; on Android, enable automatic downloads and auto-update apps in the Play Store.

4. 4

   Routers and NAS: switch on auto-update if offered

   Many current routers and NAS units can install security updates on a schedule. Pick a night-time window and keep a backup of the configuration.

5. 5

   With 10+ PCs, manage updates centrally

   Microsoft Intune update rings control deferral periods, deadlines and restarts for all Windows PCs from one console, and show which devices are behind. See Microsoft's update rings documentation.

A monthly patching routine for small offices

Pick the Wednesday or Thursday after Patch Tuesday, put a recurring 30-minute slot in one person's calendar, and work through this list.

End-of-life software: when no patch is coming

Software that has reached end of support gets no more security fixes, however carefully you update it. It needs a replacement plan.

• Windows 10 reached end of support in October 2025. Businesses can buy Extended Security Updates for a limited time; see our Windows 10 ESU options guide.
• Office 2016 and Office 2019 stopped receiving security updates on 14 October 2025, per Microsoft's end-of-support page.
• Office LTSC 2021 reached end of support on 13 October 2026, according to Microsoft's Office version table.
• Routers, NAS and CCTV recorders often stop getting firmware after a few years. Check the vendor's support page for your model.
• Old phones fall off the update list too. A phone with company email that no longer gets security updates should be replaced.

CSA's Cyber Essentials standard says organisations "should remove or replace any IoT devices (e.g., CCTVs, printers) that are not receiving any software patches or updates". Where you truly cannot replace something yet, isolate it: separate network, no internet access, no admin logins from it.

Patching evidence for Cyber Essentials and insurers

The Cyber Essentials (2025) standard has a whole category called Update. In short, it asks you to prioritise critical and important updates from official sources "as soon as feasible", to consider automatic updates where feasible, and to patch known exploited vulnerabilities as soon as possible.

An assessor or cyber insurer will want to see that this happens in practice, not just in a policy. Keep:

• Your asset list (devices and software) with the person responsible for each
• Screenshots or a report showing devices are up to date, such as an Intune compliance report
• The monthly patch log, including anything deferred and why
• Your list of end-of-life items and the replacement date for each

For the full checklist across all five areas, see our Cyber Essentials mark checklist.

Do it yourself or get help?

For a team of under ten with laptops, phones and one router, the routine above is very manageable in-house. The hard part is consistency, so give it to one named person and put it in the calendar.

Help makes sense once you have more devices than you can check by hand, staff working from home, or a certification deadline. Our Device Encryption & Management rollout (S$490) puts Windows and Mac devices under central update policies with compliance reports. Protect Standard (S$19 per user per month) adds ongoing monitoring of updates and endpoint protection, so the monthly check is done for you.