A patching routine that keeps every device current

The short answer

Patch management best practices for a small business come down to six habits: keep a complete list of devices and software, automate updates for Windows, Mac, browsers and common apps, test on a small pilot group before everyone else, patch on a fixed monthly schedule with faster deadlines for flaws being actively exploited, handle exceptions in writing with an end date, and report every month on what is still missing. Do not forget firewalls, VPNs, printers and other firmware, which are often the easiest way in.

The stakes rose in 2026. Verizon’s 2026 Data Breach Investigations Report found that exploited software vulnerabilities were the most common way attackers first got in, at 31 percent of breaches, overtaking stolen credentials for the first time in the report’s history.

Step 1: know what you have

You cannot patch what you do not know about. Keep an inventory of:

• Every laptop, desktop and server, with operating system and version
• Phones and tablets that access company email or files
• Firewalls, VPN appliances, switches, Wi-Fi access points and routers
• Printers, scanners, network storage and security cameras
• Installed software, especially browsers, PDF readers, remote access tools, Java and line-of-business apps

A device management tool, such as Microsoft Intune or a remote monitoring platform, can build most of this list automatically. Network gear usually has to be listed by hand.

Step 2: set a schedule

NIST’s guide to enterprise patch management (SP 800-40 Rev. 4) frames patching as routine preventive maintenance and recommends defined maintenance plans rather than ad hoc updates. The CIS Critical Security Controls call for automated operating system and application patching on a monthly or more frequent basis. A practical calendar:

• Windows: Microsoft releases security updates on the second Tuesday of each month. Pilot devices get them within a few days; everyone else about a week later.
• macOS and iOS: Apple releases updates on no fixed schedule. Use device management to set an install deadline after each release.
• Browsers: Chrome, Edge and Firefox update themselves. Make sure users restart them and that auto-update is not blocked.
• Third-party apps: Check monthly, or automate through your management tool.
• Firmware: Review firewalls, VPNs and network storage monthly, and other devices quarterly.

Step 3: prioritize by real risk

Not every patch is equally urgent. Use deadlines like these, adjusted to your environment:

1. Actively exploited flaws: within days. CISA’s Known Exploited Vulnerabilities catalog lists flaws confirmed to be used in attacks, and CISA says organizations should use it as an input to how they prioritize patching.
2. Critical flaws in internet-facing systems, such as firewalls, VPNs and remote access tools: as fast as possible, often within a week.
3. Other critical and high-severity updates: within about two weeks.
4. Everything else: within the monthly cycle.

Internet-facing devices deserve special attention because attackers scan for them constantly and they often sit outside normal update tools.

Step 4: test without stalling

Use deployment rings. A pilot group of a few people, including someone from each department, gets updates first. If nothing breaks after a few days, release to everyone. Microsoft’s update tools, including Windows Update for Business and Windows Autopatch, support rings and deadlines. For a line-of-business app that has broken before, test it on a pilot machine first, but set a firm date to finish.

Make sure restarts actually happen. Many updates do not take effect until a reboot, so set a deadline that forces one outside working hours.

Do you know how many of your computers are behind on updates right now? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

Step 5: handle exceptions in writing

Sometimes a patch cannot go on, usually because a vendor has not certified it or old equipment cannot run it. Treat that as a documented exception, not a forgotten device:

• Record the device, the missing update and the reason.
• Name an owner and an end date for the exception.
• Add compensating controls, such as isolating the device on its own network segment, removing internet access or restricting who can log in.
• Review all exceptions monthly and close them as soon as possible.

Step 6: replace what can no longer be patched

Unsupported software never gets security fixes. Windows 10 reached end of support on October 14, 2025. As of 2026, Microsoft lists its Extended Security Updates program for businesses at $61 per device for the first year and doubles each year, for up to three years. That buys time, not a plan. Budget to replace or upgrade unsupported computers, servers, firewalls and network storage before they reach end of life.

Who owns patching

Patching fails most often because nobody clearly owns it. Write down who does each part:

• Operating systems and common apps: your IT person or provider, through a management tool.
• Firewalls and network gear: whoever manages the network, which may be a separate vendor. Get their update schedule in writing.
• Line-of-business software: often the software vendor. Ask how they notify you of security updates and who installs them.
• Phones and tablets: users install updates, but device management should enforce a minimum version before a phone can open company email.
• Approval and exceptions: an owner or office manager who signs off on delays and replacement budgets.

If a vendor manages a system for you, ask for a short monthly note on its patch status so it appears in your report alongside everything else.

Step 7: report every month

A one-page monthly report keeps patching honest. Include:

• Percentage of devices fully up to date
• Devices missing updates for more than 30 days, by name
• Status of any actively exploited flaws that apply to you
• Firmware status for firewalls and network devices
• Open exceptions and their end dates
• Devices that have not checked in, which may be lost or switched off

Cyber insurers increasingly ask about patching and may scan your internet-facing systems, so this report also helps at renewal.

Common gaps in small businesses

• Laptops that stay asleep or off-site and never finish updating
• A firewall or VPN that has not been updated since installation
• Users with admin rights who decline or postpone updates
• Old servers kept running for one application
• Personal devices accessing company email with outdated systems

JLB USA’s managed IT includes computer setup, updates and patching, and our cybersecurity services add endpoint protection and monitored backups, so a missed patch is not the only thing between you and an attacker. We reply within 5 minutes by email or phone when something breaks after an update.

Keep reading

• Do you need to back up Microsoft 365? Yes, and here is why
• VPN vs ZTNA: which is right for your remote staff?
• User access review process: how to run quarterly reviews in a small business
• Cyber insurance requirements in 2026: what insurers commonly ask for

Related services

• Managed IT services
• Cybersecurity services
• Free Technology Health Assessment