Patch Management for Small Business: A Practical Update Policy

Monday morning in the accounts office of a small company in Sofia. The "Restart to finish installing updates" prompt pops up again — and once again someone clicks "Later." The router hasn't been updated since the day it was installed, the PDF reader is three years old, and the old PC in the warehouse "still works" on Windows 10. Nobody is to blame — it's simply that nobody owns updates. That gap is exactly the door attackers love, and closing it is what patch management for small business is all about.

The good news: managing updates doesn't require a large IT department. It takes a clear policy, a bit of discipline, and the right tools. In this article you'll learn what needs updating, how quickly, and how to do it without bringing the office to a halt.

Why unpatched systems are an open door

Every monthly batch of updates fixes vulnerabilities that are already public. Once a vendor releases a fix, attackers can compare the old and new versions and work out exactly where the weakness is. From that moment on, every unpatched system is an easy target.

The US Cybersecurity and Infrastructure Security Agency (CISA) maintains a public catalog of vulnerabilities with evidence of active exploitation in real attacks — the Known Exploited Vulnerabilities (KEV) catalog. It already lists more than a thousand entries, from Windows and browsers to VPN appliances, firewalls, NAS devices, and printers. Annual breach reports such as the Verizon DBIR also rank vulnerability exploitation among the main ways attackers get into a network.

The takeaway is simple: most successful attacks don't rely on some "magic" unknown exploit, but on old, long-patched holes in systems nobody got around to updating. That's why updates are one of the must-do measures we covered in Cybersecurity for small business — 10 essential measures.

There's a regulatory angle, too. GDPR requires "appropriate technical measures" to protect personal data, and the EU's NIS2 directive explicitly lists vulnerability handling among its cybersecurity risk-management measures. It's hard to show due care if your server hasn't been updated in a year.

What actually needs updating

When people hear "updates," most picture Windows Update. The real list is much longer:

• Operating systems — Windows, macOS, Linux servers
• Browsers — Chrome, Edge, Firefox, Safari (they usually update themselves, but only take effect after a browser restart)
• Office suites — Microsoft 365, older Office versions, LibreOffice
• Third-party applications — PDF readers, Java, 7-Zip, Zoom, Teams, accounting software, drivers
• Network equipment — routers, firewalls, VPN gateways, switches, Wi-Fi access points
• NAS devices — Synology, QNAP, and others, which are often exposed directly to the internet
• Printers, IP cameras, and video recorders — their firmware is rarely updated, yet they're always on the network
• Websites — WordPress core, themes, and plugins
• Servers and virtualization — Windows Server, hypervisors, management controllers (iLO, iDRAC)
• Mobile devices — company phones and tablets with access to email and files

Devices at the "edge" of the network deserve special attention — routers, firewalls, and VPN appliances. In recent years, vulnerabilities in products from major firewall and VPN vendors have repeatedly been exploited at scale, often within days of being disclosed.

End-of-support systems: what to do about Windows 10

Microsoft ended support for Windows 10 on October 14, 2025. PCs keep working after that date, but they no longer receive free security updates. Office 2016 and Office 2019 reached end of support on the same day.

For businesses, Microsoft offers a paid Extended Security Updates (ESU) program. According to Microsoft, it's purchased per device, one year at a time, the price doubles each consecutive year, and it runs for a maximum of three years after end of support. ESU only works on Windows 10 version 22H2 and delivers security fixes only — no new features and no technical support.

ESU is a bridge, not a solution. If you still have Windows 10 machines, use this time to plan the migration. If a PC doesn't meet Windows 11 requirements, it's probably time to replace it — see How Long Does Technology Actually Last? for realistic hardware lifespans.

When replacement isn't possible right away

Sometimes an old machine runs specialized equipment or legacy software with no newer version. In that case:

• Isolate it on a separate network segment (VLAN) with access only to what it needs
• Block its access to the internet, email, and web browsing
• Don't store data on it that it doesn't need, and back it up regularly
• Document the risk and set a deadline for replacement

A practical patch management policy

A good policy answers three questions: what do we have, who updates it, and how fast. Here's a framework that works for an office with 5 to 50 computers.

1. Inventory

You can't update what you don't know about. List every computer, server, network device, printer, camera, and key application — with versions and end-of-support dates. Remote monitoring and management (RMM) tools collect much of this automatically.

2. Deployment rings (pilot and broad)

Don't push every update to everyone at once. Split devices into groups:

• Pilot ring — the IT lead's computer and 1–2 experienced users; they get updates first
• Broad ring — everyone else, a few days later, if the pilot went smoothly
• Critical systems — servers and machines running specialized software, updated last and on a schedule

3. Maintenance windows

Set a fixed time for installing updates and rebooting — for example, in the evening after hours or on a set day of the week. Staff know when to expect a restart, and servers get updated without interrupting work. Computers need to be powered on during that window, or updates will "surprise" people in the morning.

4. Deadlines by severity

• Actively exploited or critical vulnerabilities (for example, those in the CISA catalog) — within days, outside the normal cycle
• Important security updates — within two to four weeks
• Feature updates (a new Windows 11 version, a major application release) — scheduled, after testing

5. Back up and test before changes

Before updating a server, a NAS, or firewall firmware, make sure you have a fresh, verified backup — and for network devices, a saved configuration. If an update goes wrong, rolling back should take minutes, not days. We explain how to build a reliable backup in Data Backup: The Complete Guide for Small Business.

6. Reboots are part of the process

Many updates don't take effect until a restart. A computer that "hasn't been shut down in months" is effectively unpatched. Set a maximum deferral period, after which the reboot becomes mandatory.

7. Monitoring and reporting

A policy nobody checks doesn't work. Track centrally which devices are up to date, which have failed installs, and which haven't checked in at all. Review the report once a month and close the gaps.

Monthly patching checklist

Microsoft releases its regular security updates on the second Tuesday of every month — known as Patch Tuesday. Use it as the rhythm for the whole process:

1. On the second Tuesday, review what was released and whether any vulnerabilities are being actively exploited
2. Deploy updates to the pilot ring the same week or the next
3. Gather feedback from the pilot — printers, accounting software, line-of-business apps
4. Roll out to the broad ring in the next maintenance window
5. Back up and update servers in a scheduled window
6. Check for new firmware on routers, firewalls, NAS devices, printers, and cameras
7. Update the website — WordPress core, themes, and plugins (after a backup)
8. Review the report: which devices are lagging, and why
9. Update the inventory — new devices, upcoming end-of-support dates
10. Record every exception and its deadline

Frequently Asked Questions

Are automatic Windows updates enough?

Automatic updates are a good foundation, but they mainly cover the operating system and Microsoft products. Third-party applications, network device firmware, and your website need separate attention. And without central monitoring, you don't know whether updates were actually installed and whether computers were restarted.

How quickly should we install a critical update?

If a vulnerability is already being exploited in the wild, aim to patch it within days. For other security updates, two to four weeks is a reasonable target. The more exposed a device is to the internet — VPN, firewall, website — the more urgent it is.

Can we keep using Windows 10?

The computers will keep running, but without security updates after October 14, 2025 they become increasingly risky. Businesses can buy paid Extended Security Updates (ESU) for a limited period, but that's only a temporary bridge. The best course is to plan a move to Windows 11 or a hardware refresh.

What if an update breaks something?

That's exactly why the pilot ring and pre-change backups exist. Most Windows updates can be uninstalled, and for servers and firmware you roll back from a backup or saved configuration. The issue is documented and the update is paused only for the affected machines, not for everyone.

Do printers and cameras really need updates?

Yes. Printers, IP cameras, and video recorders are full-fledged computers on your network and often have serious vulnerabilities. Check for new firmware at least every few months and keep these devices on a separate network segment.

How SNM Support takes updates off your plate

Patch management is routine but relentless work — which is exactly why it gets neglected. As part of our subscription IT support, SNM Support handles the whole cycle: inventory, deployment rings, maintenance windows, backups before changes, firmware updates for your network equipment, and a monthly report showing what's patched and what's lagging. Much of the work is done through remote support, without interrupting your team.

If you're not sure how far behind your systems are, or you still have Windows 10 machines, book a free initial consultation via our contact page or call +359 88 273 6921. We'll review where you stand and propose a realistic plan of action.