Patch management for small businesses: how to keep systems updated without breaking them
Unpatched software remains one of the main ways attackers get into company networks. At the same time, everybody has a story about an update that broke a printer, a VPN or an accounting program. Good patch management is the balance between these two risks: update quickly, but in a controlled way.
What needs patching
- Operating systems on laptops and servers: Windows, macOS, Linux.
- Third-party applications: browsers, PDF readers, Zoom, Java, 7-Zip. These are often forgotten and frequently exploited.
- Network devices: firewalls, VPN gateways, switches, Wi-Fi access points. Firmware vulnerabilities in VPN gateways have been behind many recent attacks.
- Servers and their software: hypervisors, databases, web servers.
- Websites and plugins, covered in our WordPress maintenance checklist.
A simple monthly rhythm
Microsoft releases most security updates on the second Tuesday of each month, so many teams build their process around it:
- Week 1: review the released updates and any known issues.
- Week 1 to 2: install on a pilot group, for example IT and two or three volunteers from different departments.
- Week 2 to 3: if nothing broke, roll out to all workstations.
- Week 3: patch servers in an agreed maintenance window, with a fresh backup or snapshot taken first.
- Week 4: check compliance and follow up on devices that did not update.
Urgent security fixes
Some vulnerabilities cannot wait for the monthly cycle, especially those that are already exploited in the wild and affect internet-facing systems such as VPN gateways, firewalls, email servers and websites. Define in advance what counts as urgent, who decides and how fast you act. For exposed systems, the target should be days, not weeks.
Tools that help
- Windows Update for Business or Intune for Windows devices in Microsoft 365 environments.
- An RMM tool that patches both the operating system and common third-party apps.
- Unattended upgrades for security updates on Linux servers.
- A vulnerability scanner to find what patching missed.
How to avoid breaking things
- Always have a pilot group before rolling out to everyone.
- Take snapshots of virtual machines before patching servers.
- Keep a list of critical applications and test them after updates.
- Communicate maintenance windows so nobody is surprised by a restart.
- Document known issues and how to roll back.
Measure it
Two numbers tell you whether patch management works: the percentage of devices fully updated, and the time from release to installation for critical patches. If you cannot get these numbers today, that is the first thing to fix.
Monthly patching of servers and network devices is included in all our infrastructure plans, and the free IT audit shows outdated software visible from the internet.