Keep software updated — why it matters
Most successful attacks exploit holes that were already fixed — on machines that hadn't installed the fix. Updating promptly is defense, not housekeeping.
Software updates feel like interruptions. They're actually the fastest
security race on the internet: when a vulnerability becomes public,
attackers begin scanning for machines that haven't patched it —
within days, sometimes hours. An update you defer for two weeks is a
two-week open window.
What this means in practice
- When your device asks, schedule — don't snooze forever. Pick
tonight, plug it in, let it finish. The restart is part of the
fix: an update waiting on a restart protects nothing yet.
- It's not just Windows. Browsers, PDF readers, meeting apps,
and phone apps all patch security holes. Browsers usually just
need a relaunch; phones update overnight on charge if you let
them.
- Update before travel and before big days — not the morning
of. A machine restarted and patched the night before a deadline
is a machine that won't choose that morning to insist.
- Beware fake "updates." Real updates come from the software
itself or your system's update settings — never from a website
pop-up shouting that your player is out of date, or an email
attachment. Those are the attack (the checks: KB-0021).
On managed work devices
Your IT provider schedules and tests updates centrally — the prompts
you see are usually just asking when to restart. Answering "tonight"
instead of snoozing for a week is your entire part of the system, and
it genuinely matters: fleets stay safe when restarts happen.
The mindset
Updates are the vaccine schedule of computing: mildly inconvenient,
occasionally annoying, and the reason the bad stuff mostly happens to
machines that skipped them.