Update notifications get postponed for months: inconvenient, time-consuming, “it works as it is”. Meanwhile most successful attacks on ordinary people come not through clever schemes but through vulnerabilities patched six months ago.
What happens after a patch ships
- Day one
The update ships. Along with it, a description of the vulnerability. Until then a narrow circle knew; now anyone interested does.
- First week
A ready-made tool appears. From the description, the attack is reproduced and published openly. The skill required drops to zero.
- After that
Mass scanning. The vulnerability is not sought at you personally but by sweeping the whole internet. Whoever has not updated is caught, indiscriminately.
So the gap between a patch shipping and being installed is the most dangerous time, not the calmest.
What must be updated
| What | Why it matters | How |
|---|---|---|
| The browser | The main door to the internet; its flaws are exploited first | Auto-update, restart every couple of days |
| The operating system | Patches close flaws exploitable without your involvement | Auto-update |
| The banking app | It handles money and confirmations | Auto-update |
| The router | All home traffic passes through it and it is rarely updated | Manually, twice a year |
| Smart devices | Few updates, and they live for years | Check at setup and twice a year |
| Browser extensions | They have access to page contents | Delete the unused ones, update the rest |
When waiting makes sense
Caution is justified in two cases, and both are rare.
- A major system upgrade in its first days. Not a security patch but a whole version change: those do break things. A week of waiting is reasonable.
- A work computer with critical software. If your work depends on it, check compatibility first.
Ordinary security updates should not be postponed: they are small, install in a minute and fix exactly what is already being exploited.
- The notification sits there for months
- Updates installed “when there is time”
- The router still runs its factory firmware
- Nobody has reviewed the old browser extensions
- Auto-update on wherever it exists
- The browser is restarted regularly
- Router firmware checked twice a year
- Unnecessary extensions removed
Router settings in detail are in home network security, and smart devices in the smart home.