Software updates: why the reminder matters

The short version

Updates are how the makers of software fix problems after release, including security weaknesses that attackers could use. CISA and the UK NCSC both list keeping software updated among the most important things an individual can do, and both recommend switching on automatic updates so it happens without you having to remember. The two cautions are to get updates only from the real source, and to notice when a device has stopped receiving them.

What a patch is

CISA's explainer on patches and software updates describes a patch as a piece of software that a vendor releases to fix a problem in a product, often a security weakness. Large programs and operating systems contain millions of lines of code written by people, and some mistakes are only found after release, by the maker, by researchers or, in the worst case, by attackers who are already using them.

Not every update is about security. Some add features, change how things look or fix ordinary bugs. But security fixes are frequently bundled into the same update, and release notes do not always spell them out. The safe assumption is that any update from the real source may include protection you need.

Updates arrive in different forms depending on the device: operating system updates for a phone or computer, app updates through an app store, browser updates that often install themselves, and firmware updates for things like routers, printers, cameras and smart televisions.

Why timing matters

When a fix is published, it also tells the world that a weakness existed. People who want to misuse it can study the fix to understand the flaw, then look for devices that have not been updated yet. That is why both CISA and the NCSC frame updating as something to do promptly rather than eventually. A device that applies updates within days is a much harder target than one that waits months.

The FTC's guidance on malware makes the same connection from the other direction: keeping your operating system, browser and apps updated is one of its core steps for avoiding malicious software, because many attacks rely on weaknesses that updates have already fixed.

Automatic updates

CISA's Secure Our World guidance and the NCSC's top tips both recommend turning on automatic updates wherever they are available. Most phones, computers, browsers and app stores offer this, usually in a section of settings called updates, software update or system. Many let you choose a time, such as overnight, so a restart does not interrupt you.

Automatic updates are not perfect. Occasionally an update causes a problem, and some people prefer to wait a few days. That is a reasonable choice for a work machine with special software, but for most household devices the risk of falling behind is larger than the risk of an occasional faulty update. If you do turn automatic updates off, set yourself a regular time to install them by hand.

The devices people forget

Phones and computers nag you to update. Other devices do not, and they are often the ones left behind:

• The router. CISA's wireless network guidance includes keeping router firmware up to date. Some routers update themselves; others need you to check in their settings page or app. See the internet and router explainer.
• Smart devices. Cameras, doorbells, speakers, televisions and plugs all run software. Their companion apps usually show whether an update is available.
• Apps you rarely open. An app store can update these automatically, but only if that setting is on.
• Old devices in drawers. A tablet that has been off for a year will need several updates before it is safe to use again. Let it finish before signing in to anything.

Real updates and fake prompts

Because people have learned that updates matter, scammers imitate them. A web page may suddenly claim that your browser or a media player is out of date and offer a download. A pop-up may warn that your computer is infected and urge you to install a fix or call a number. CISA advises getting updates only from the software's own update feature or the official app store, and the FTC describes warnings and pop-ups like these as common routes for malware and tech support scams.

A simple rule covers most cases: do not update anything from a link or pop-up on a web page or in a message. If you think something might genuinely need updating, close the page, then open the program's own settings or your device's app store and check there. Real updates for your operating system and apps come through those routes.

When updates stop

Every device and program eventually reaches the end of its support period, after which the maker stops releasing security fixes for it. The device keeps working, but any weakness found after that date stays open for good. This is the quiet risk behind an old phone or computer that still seems fine.

The NCSC's update guidance makes this point for older devices that no longer receive updates. Device settings often say whether the current version is still supported, and makers usually publish support periods. When a device that holds important accounts or data stops getting updates, it is worth planning to replace it or to move those accounts and data to something that is supported.

A simple routine

1. Turn on automatic updates on every phone, tablet and computer in the household, including the app store setting for apps.
2. Check the router and any smart devices once every few months, or turn on their automatic updates if offered.
3. When an update needs a restart, let it happen at the next convenient moment rather than postponing indefinitely.
4. Never install an update offered by a web page, pop-up, email or text message.
5. Once a year, check whether any of your devices has reached the end of its support period.

Next: Phishing and scams: recognising the pattern before you reply