Keeping your software updated is one of the most effective security habits you can build, yet it's also one of the most skipped. The "remind me later" button gets clicked hundreds of times before anything goes wrong. Then something does. The reason software updates matter for security isn't abstract: attackers actively hunt for systems running older versions, because those versions have known, documented weaknesses that are trivially easy to exploit.
What actually happens when software has a vulnerability
Every piece of software has bugs. Most are annoying. Some are dangerous. A security vulnerability is a bug that an attacker can exploit to do something they shouldn't be able to: read your files, run code on your machine, intercept your data, or take over your account.
When a security researcher finds a vulnerability, they typically report it to the software vendor. The vendor writes a fix and ships it as an update. At that point, the vulnerability is disclosed publicly, often with technical details. That disclosure is the starting gun for attackers. Within hours of a patch being released, automated scanners across the internet start probing for machines that haven't applied it yet.
The gap between "patch released" and "attack attempts begin" has shrunk considerably. In several documented cases, attacks began within 24 hours of disclosure. The window to apply an update before you're at risk is genuinely short.
Why unpatched software is the most common attack entry point
Attackers prefer known vulnerabilities over zero-days. Zero-day exploits (flaws with no patch yet available) are expensive, difficult to develop, and often burned by using them. Known vulnerabilities in unpatched software are free. The technique is documented. The targets are plentiful.
This is why ransomware groups so frequently exploit unpatched VPN appliances, web servers, and operating systems. They don't need to do anything sophisticated. They scan the internet for systems showing version numbers below the patched release, then apply a known exploit. It's closer to running a script than to what most people imagine "hacking" looks like.
If you've ever wondered how ransomware attackers get into systems in the first place, unpatched software is the answer in a large share of cases. The ransomware attacks that have hit businesses of all sizes frequently trace back to a single unpatched system that served as the initial foothold.
What software updates actually contain
Not every update is purely a security fix. Updates typically bundle several things together.
- Security patches: fixes for specific vulnerabilities that could be exploited.
- Bug fixes: corrections for crashes, data corruption, or incorrect behaviour.
- Performance improvements: optimisations that make the software run faster or use less memory.
- New features: added functionality, which may or may not be relevant to you.
The security patches are non-negotiable. The rest is a bonus. When a vendor says an update is a "security release," it means they found something serious enough to ship outside their normal cycle. Those updates deserve priority.
Which software you actually need to keep updated
People tend to think of Windows or macOS updates when they hear "software updates," but the attack surface is wider than that. The software that matters most for security includes your operating system, your browser, your browser extensions, your email client, any VPN or remote access tools, and PDF readers. These are the categories that see the most exploitation in the wild, because they're the most exposed to external content and connections.
Your operating system is the foundation. Keeping macOS current closes vulnerabilities at the kernel and system-service level that no third-party tool can compensate for. The same applies to Windows. An outdated OS running good antivirus software is still a weaker posture than a current OS running average antivirus.
Third-party applications matter too. Java, Adobe Reader, and browser plugins have historically been among the most exploited software categories, precisely because users update their OS but forget everything else.
The risk of "it's working fine, I don't want to break anything"
This is the most common reason people delay updates. It's understandable. An update that breaks a workflow is a real cost. But the calculation is lopsided.
Major software vendors test updates extensively before release. Regressions happen, but they're the exception. The risk of a broken feature from an update is real but small. The risk of remaining unpatched grows every day, particularly for internet-connected machines. A broken plugin is inconvenient. A ransomware infection costs money, time, and in business contexts, can cost client data and legal liability.
If you're managing software for a business and compatibility testing is a genuine concern, the answer isn't to skip updates. It's to test updates in a staging environment before rolling them out, or to work with an IT provider who manages that process for you.
Automatic updates: when to use them and when to be careful
For personal computers, automatic updates are almost always the right choice. They remove the human delay from the equation. Windows Update and macOS Software Update both have automatic modes that download and install security patches with minimal disruption. Enable them.
For business environments, the answer is more nuanced. Automatic updates on a single workstation carry low risk. Automatic updates across a fleet of servers, or on systems running custom-built applications, carry more. A patch that breaks a dependency in a production environment can cause downtime. The solution is a managed update process, not deferred patching.
If your business relies on a mix of systems and you don't have an IT team overseeing updates, a structured approach to cybersecurity that includes patch management is worth building. The cost of a managed service is predictable. The cost of a breach is not.
End-of-life software: a category of its own
End-of-life software deserves special attention. When a vendor stops supporting a product, security patches stop too. Any vulnerability discovered after that date will never be fixed. Running end-of-life software isn't just falling behind on updates. It's running software with a permanently growing list of known, unpatched vulnerabilities.
Windows 10 reached end of life in October 2025. Any machine still running Windows 10 without an extended support arrangement is now accumulating unpatched vulnerabilities. The same applies to older versions of macOS, and to any third-party software whose vendor has discontinued it.
The fix is straightforward: upgrade or replace. If the hardware can't run a supported OS, that's the signal to replace the machine. Running unsupported software on old hardware to avoid upgrade costs is a false economy.
Updates are the cheapest security control you have
Security controls exist on a spectrum from expensive to free. Patching software is free. It takes minutes. It closes vulnerabilities that attackers actively exploit. No other single habit delivers a comparable return.
Good antivirus software, strong passwords, and network security all matter. But they're harder to maintain and easier to circumvent than a fully patched system. A well-resourced attacker with a known exploit for your unpatched software will get through most of those controls anyway. The patch stops the attack before it starts.
Update your software. Turn on automatic updates where you can. Prioritise security releases when you see them. And if you're running anything that's reached end of life, that upgrade deserves to move to the top of the list.