Hardening/Guide
Patch management for small teams: a routine that keeps up
Attackers routinely exploit flaws that already have a fix. A realistic update routine for small teams: automatic updates, a weekly slot, priorities from the known exploited list, firmware, testing and end of support.
sha256("/hardening/patch-management-routine/")Patching is rarely difficult. It fails because it is nobody’s job on a particular day, because one device was forgotten, or because a restart was postponed for three weeks. A routine fixes all three: a list of what you own, automation for most of it, a fixed weekly slot for the rest and a clear rule for what jumps the queue.
Start with an inventory
You can only patch what you know about. List every laptop, phone, server, router, firewall, NAS, printer and virtual machine, plus the software that runs on them and the cloud services you administer. For each entry note the owner, how it gets updated and when its support ends.
The list does not need a special tool to begin with. A shared spreadsheet that is updated whenever something is bought, handed out or retired is far better than a perfect system nobody maintains.
Cloud services belong on the list even though the provider patches the platform. You still own their settings and the plugins, integrations and connected apps that run inside them, and those need the same attention as anything on your own hardware.
Automatic updates wherever possible
Automatic updates handle most of the work for operating systems, browsers, office suites and phone apps. Turn them on, allow restarts outside working hours and check every month that devices actually report as up to date. The UK’s Cyber Essentials scheme asks for automatic updates where possible, and for fixes rated critical or high risk, or with a score of 7 or above, to be installed within 14 days of release.
On Debian and Ubuntu servers, the unattended-upgrades package installs updates automatically. Review which package sources it may use and decide how restarts for kernel updates are handled.
sudo apt update
sudo apt install unattended-upgrades
# answer Yes to enable automatic updates
sudo dpkg-reconfigure -plow unattended-upgrades
# allowed sources and reboot behaviour are configured here
sudoedit /etc/apt/apt.conf.d/50unattended-upgrades
# list updates that are still waiting
apt list --upgradableA weekly slot and the monthly rhythm
Automation leaves a remainder: servers that need a planned restart, business software, plugins and network devices. Give that remainder a fixed weekly slot of about an hour, on the same day each week, with a named person and a stand-in.
Microsoft publishes its monthly security updates on the second Tuesday of each month, typically at 10:00 Pacific Time, which is why the day is known as . Urgent fixes also arrive out of band, and other vendors publish on their own schedules, so the weekly slot should not wait for the monthly date.
- Check the inventory for new devices and services.
- Check the known exploited vulnerabilities list, described below, for anything you run.
- Install pending updates on servers and network devices, internet-facing systems first.
- Confirm that last week’s automatic updates landed and restarts happened.
- Note anything postponed, with a reason and a new date.
What jumps the queue
Not every update is equally urgent. Severity scores such as CVSS (Common Vulnerability Scoring System, 0 to 10) tell you how bad a flaw could be. Whether it is already being exploited tells you how likely it is to hurt you this week.
CISA, the US cyber security agency, maintains the Known Exploited Vulnerabilities catalogue: a list of flaws with evidence of exploitation in the wild, downloadable as CSV and JSON. CISA recommends using the as one input to prioritisation, and it is useful far beyond the US government. Each entry also records whether the flaw is known to be used in ransomware campaigns.
| Priority | Typical case | Target |
|---|---|---|
| 1: now | Listed in KEV and the system is reachable from the internet, such as a VPN gateway, firewall, mail server or website | Same day, or isolate and mitigate until fixed |
| 2: this week | Critical or high severity, or listed in KEV but only reachable internally | Within days, and within 14 days at the latest |
| 3: routine | Medium and low severity, feature updates | Next weekly slot or automatic cycle |
Targets are our editorial suggestion for small teams. Adapt them to your own risk and to any contractual or certification requirements.
Firmware, routers and forgotten devices
The devices between you and the internet are often the least updated: routers, firewalls, VPN gateways, NAS boxes, printers and building controls. They are also attractive targets, because they run around the clock and are reachable from outside.
- Turn on automatic updates where the device offers them.
- Subscribe to the vendor’s security advisories for every network device you own.
- Close remote administration from the internet unless you truly need it.
- Replace devices whose vendor no longer ships firmware updates.
- Include browser extensions and CMS plugins, which update separately from the browser or the CMS.
Test on one machine first
Updates occasionally break things. The answer is not to delay them but to stage them. Let one machine, or one person who is comfortable reporting problems, receive updates a day or two before everyone else.
Servers get a snapshot or backup before the update and a short note on how to roll back. If the pilot shows a problem, pause the rollout for that one update, report it to the vendor and set a date to try again. Everything else keeps flowing.
Plan for end of support
Once a product reaches , new vulnerabilities are no longer fixed. Windows 10, for example, reached end of support on 14 October 2025, with security fixes after that only through Microsoft’s extended security updates programme.
Check the vendor lifecycle pages for every operating system, server distribution, CMS and network device in your inventory, and put the dates in the calendar a year ahead. Cyber Essentials requires unsupported software to be removed or cut off from the internet, which is a sound rule even outside the scheme.
When a replacement is not possible straight away, reduce the exposure: take the device off the internet, move it to its own network segment and write down the decision with a review date. That turns a forgotten risk into a known and temporary one.
Sources and further reading
General information, checked on 31 October 2026. Test changes on one system first and keep a way back. Found something outdated? Tell the editors.
