Updating your software is the most repeated security measure, and probably the most poorly applied one. Not out of negligence: because the easy part, clicking “install”, hides the hard part, knowing what is actually running in the business.
An SME updates its computers. It almost always forgets the router installed six years ago, the network printer, the NAS storing the drawings, and the management software that forces it to stay on an old version of Windows.
What is a vulnerability, in plain language?
Software is a manufactured object, and like any manufactured object, it contains flaws. A security vulnerability (or flaw) is a particular kind of defect: it allows someone to get the program to behave in a way its designer never intended. Reading a file it has no right to, running a command, bypassing a password prompt.
These flaws are not added by attackers. They have been there from the start, sometimes for years, and someone eventually finds them. At that point, the software vendor writes a fix and releases it: that is the update. It does not make your system faster, it plugs a hole.
Hence a point that often surprises business owners: there is no way to protect yourself from a vulnerability without installing the fix. Antivirus software, a firewall or a strong password do not replace the repair, they only make it harder to reach the hole that is still open.
Why does timing matter so much?
When a vendor publishes a fix, it also implicitly publishes the existence of the flaw it corrects. Fixes are analysed, including by people with bad intentions, who work out precisely what was vulnerable and how to exploit it.
From that point on, the race is on. Automated programs continuously scan the Internet looking for equipment that has not yet been updated. They do not target anyone in particular: they test everything that responds, and a six-person SME is just as valid a target as a large corporation, sometimes more so, because it will take longer to react.
For the most exposed vulnerabilities, those affecting equipment directly reachable from the Internet, the first large-scale exploitation attempts follow the publication of the fix very closely. An update postponed to "the next quiet moment" is often postponed past the useful window. This is the decisive argument in favour of automation: it removes the human delay.
Turning on automatic updates on workstations, phones and browsers takes a few minutes and solves a large part of the problem. It is the single most cost-effective measure in an SME’s entire cybersecurity effort.
The devices everyone forgets
The “update” reflex applies to computers. It stops there, even though an SME’s network contains a whole range of equipment that also runs software, under the name firmware.
| Equipment | What it exposes | What stops it from being updated |
|---|---|---|
| Internet box or router | Entry point to the whole network | Installed once, never revisited |
| NAS, file server | All of the company’s documents | Admin interface rarely checked |
| Multifunction printer | Scanned documents, address book, sometimes broad network access | No one thinks of it as a computer |
| Security cameras | Internal footage, remote access | Installed and forgotten by the installer |
| Industrial controllers, connected machines | Production itself | Fear of breaking equipment in service |
| Personal phones | Business e-mails and documents | Private hardware, outside company control |
Two cases deserve particular attention. Security cameras and entry-level network equipment are regularly targeted by automated attacks, often because they still have their factory password on top of their factory firmware. And personal phones used for work fall completely outside the inventory: a device that no longer receives fixes and reads the management’s mailbox is a serious blind spot.
This equipment is also the classic entry point for a wider compromise, as described in our articles on ransomware and on e-mail compromise.
What to do when an update is not possible
There are situations where updating is not an option. Business software that only runs on an old version of Windows. A production machine controlled by a system the manufacturer no longer supports. Accounting software whose current version would require a full migration.
In these cases, the wrong answer is to wait and hope. The right answer has a name: isolation. The principle is simple: since the hole cannot be closed, you reduce everything that can reach it and everything it can reach.
In practice, this means separating the equipment from the rest of the network, so that a machine infected elsewhere cannot reach it. Cutting its Internet access when that is compatible with how it works. Restricting the accounts allowed to connect to it. Banning removable media. And backing up this equipment with the same care as the rest, following the 3-2-1 rule.
Illustrative scenario. A twenty-person workshop runs a cutting machine with a computer on a version of Windows that is no longer supported. The manufacturer does not certify its software beyond that version. The computer is on the same network as accounting, because that was convenient for printing. A malicious e-mail opened in the office spreads, and production stops at the same time as invoicing. The outdated computer was not the problem: the problem was that it shared the network with everything else.
End of support: the risk you cannot see
Every operating system, every piece of software has a date beyond which its vendor stops publishing fixes. This is end of support.
What makes this deadline unusual is that nothing happens on the day it arrives. The machine starts up normally, files open, employees notice no difference at all. No warning light comes on. The change is elsewhere: from that date on, every newly discovered vulnerability stays permanently open on that device.
The gap widens silently. A system abandoned two years ago accumulates two years of known vulnerabilities, publicly documented, and built into automated attack tools. It is the exact opposite of a breakdown: a breakdown is visible and gets repaired, end of support is invisible and never gets repaired.
Hence a simple management rule: end-of-support dates should be noted at the time of purchase, not when the problem arises. A planned replacement gets budgeted, an emergency replacement after an incident just gets endured.
Organising all this without an in-house IT person
Most French-speaking Swiss SMEs do not have an in-house IT department. Here is a realistic way to organise this.
Automate everything that can be automated. Workstations, phones, browsers, office suites: automatic updates turned on, no exceptions. This one point covers most of the volume.
Keep a written list of your equipment. A simple table is enough: each connected device, who installed it, how to access its admin interface, and its end-of-support date if known. This document almost never exists in an SME, and it is exactly what is missing on the day of an incident.
Set a quarterly appointment. One hour, once a quarter, to review what is not automated: router, NAS, printers, cameras, business software. Put it in the calendar, or it will not happen.
Write updates into your contracts. If a provider installs or maintains a piece of equipment, the question “who applies the fixes, and how often?” needs a written answer. Many devices are updated by no one because each side assumes it is the other’s job. This links to the topic of supply chain attacks.
Turning on automatic updates is within everyone's reach. Knowing what is actually running in a business is not. Which devices are visible from the Internet, which versions are actually installed, which systems have gone past end of support, which software is holding back the rest of the fleet: this requires a technical inventory that no business owner can produce from memory. This is exactly what an audit brings to light, and the list almost always includes devices no one remembered installing.
These measures form a solid foundation, but they do not replace an assessment of your own situation. To gauge your current level, the cyber check-up includes several questions on updates and end of support, and the public exposure tool shows what your equipment reveals from the Internet. The other priorities are grouped in the Best practices pillar, in particular the 10 essential measures.