Cybersecurity Awareness Month, Week 3: Why That Update Notification Isn't Nagging You
Two weeks ago we covered the basics worth checking. Last week, passwords and MFA. This week: the notification you've probably clicked "remind me later" on more times than you'd like to admit.
That "update available" alert on your POS system, your practice management software, your firewall firmware, it's not nagging you. It's patching a known vulnerability that attackers are actively scanning for, right now, across the internet.
Why Unpatched Software Is Such a Common Way In
Unpatched software is one of the most common ways attackers get into small business networks not because the attack is sophisticated, but because the fix was sitting there unapplied. Once a vendor publishes a security update, the vulnerability it fixes becomes public knowledge. Attackers don't need to find a new weakness; they just need to find businesses that haven't applied the fix yet.
Where This Gets Missed
Most businesses are reasonably good about updating laptops and desktops. The gaps tend to show up elsewhere:
Network equipment - firewalls, routers, and switches need firmware updates too, and they're easy to forget because they "just run" in the background
Line-of-business software - POS systems, practice management platforms, donor management tools often run on older versions because updating feels riskier or more disruptive
Servers - especially ones running older operating systems that are no longer actively maintained by IT
IoT and connected devices - cameras, smart thermostats, medical devices frequently overlooked entirely
What To Actually Do This Week
Turn on automatic updates wherever it's safe to do so - for most standard business software, this is the lowest-effort, highest-impact step.
Check for any "critical" update your team has been postponing - if there's a specific reason it's been delayed (compatibility concerns, fear of downtime), that's worth a real conversation rather than indefinite postponement.
Don't forget network equipment - ask whoever manages your firewall and router when they were last updated.
Inventory anything running on an outdated or unsupported operating system - these can't be patched at all anymore, which makes them a standing risk until replaced.
The Bottom Line
Patch management isn't glamorous, and it's easy to deprioritize when nothing has gone wrong yet. But it remains one of the most consistent findings in breach investigations: the vulnerability that let the attacker in had a fix available, it just hadn't been applied. A regular patching routine, even a simple one, closes that door.
Next week: why "we have backups" and "we can actually recover" are two very different statements. Follow along all October as we cover one focused cybersecurity topic a week.
Sentinel Technology Solutions helps healthcare, hospitality, and nonprofit organizations build IT environments that are secure, compliant, and resilient. Reach out if you'd like a no-pressure look at where your business actually stands on patch management.
Comments