Patch management for SMEs: plan, prioritise and verify updates

Why patch management delivers a lot of protection for little money

Many attacks do not start with a new, unknown vulnerability but with a flaw for which the vendor has already released an update. An unpatched VPN gateway, an outdated browser or a firewall running old firmware is often enough. Installing updates, by contrast, mainly costs organisation and some time.

Good patch management is therefore less a question of expensive tools than of a clear process. It consists of six steps: build an inventory, prioritise vulnerabilities, test updates, roll them out in rings, verify the result and report regularly. The following sections show what this looks like in practice in a small or medium-sized business.

Step 1: a complete inventory as the foundation

You can only update what you know about. The inventory lists every device and every piece of software with its version, location and responsible person. A device management tool records PCs and servers automatically, while network and security equipment often has to be added by hand.

• Workstations, laptops and servers with operating system and version
• Installed applications, including browsers, PDF readers and remote support tools
• Firewalls, VPN gateways, switches and Wi-Fi access points
• Cameras, recorders, access control systems, printers, NAS and other IoT devices
• Vendor support: until when security updates will be provided

Step 2: actively exploited vulnerabilities first

Not every update is equally urgent. The CVSS base score describes how severe a vulnerability is technically, but it says nothing about whether it is already being actively exploited. Yet that is exactly what decides the order of work. A useful reference point is the public Known Exploited Vulnerabilities (KEV) Catalog published by the US Cybersecurity and Infrastructure Security Agency (CISA), which lists vulnerabilities with confirmed exploitation. In Austria, CERT.at publishes warnings about critical vulnerabilities.

Where a system sits also counts. Firewalls, VPN access, email servers and web applications can be reached directly from the internet and therefore take precedence over an internal test machine.

These time frames are an example and should fit your business. What matters is that they are set down in writing and that every exception is justified.

Steps 3 and 4: test and roll out in rings

In rare cases, updates can disrupt applications or cause problems on restart. Instead of updating every device at once, roll updates out in stages, known as rings. If a problem shows up in an early ring, you stop the rollout before it affects the whole business. For actively exploited vulnerabilities, the rings are shortened to hours or a few days.

1. Ring 0: the IT team and test devices, immediately after release.
2. Ring 1: a pilot group from different departments, after one to three days without problems.
3. Ring 2: all remaining workstations, about a week after release.
4. Servers and critical systems: in the maintenance window, after a current backup or snapshot and with a rollback plan.

Agree fixed maintenance windows

Set fixed times when restarts are allowed, for example one evening a week for workstations and one date a month for servers. Microsoft releases its regular security updates on the second Tuesday of each month, and many companies plan their windows around this. Announce the dates and enforce restarts after a deadline, because an update that is installed but not yet active does not protect you.

Do not forget third-party applications and firmware

Applications outside Windows Update

Windows Update takes care of the operating system and, depending on the settings, other Microsoft products. Browsers, PDF readers, file compression tools, video conferencing or remote support software often update separately or not at all. A device management or RMM (remote monitoring and management) tool can update these applications centrally. Uninstall whatever nobody needs, because every unnecessary program increases the attack surface.

Firewalls, switches, cameras and IoT

Network and security devices receive their updates as firmware, and this is exactly what gets neglected in many businesses. Firewalls and VPN gateways sit directly on the internet and are a popular target. Switches, access points, cameras, recorders and NAS devices also belong in the plan. These devices need their own maintenance windows, because a restart briefly interrupts internet access, the network or video recording. Back up the configuration before every firmware update. How to protect cameras beyond updates is covered in our article on securing IP cameras.

Systems without updates: dealing with end of life

Sooner or later every vendor stops providing security updates for a product. Since October 2025, the standard editions of Windows 10 only receive security updates through the Extended Security Updates (ESU) programme, which is time-limited and generally paid for businesses. Support for cameras, routers or NAS devices also often ends after a few years. Such a system becomes more vulnerable with every newly discovered flaw.

• Plan the replacement and budget for it in good time, ideally before support ends.
• If a device cannot be replaced immediately, isolate it in its own network segment without internet access.
• Use paid extended support programmes where available, as a bridge with a fixed end date.
• Document every exception with a reason, a responsible person and an expiry date.

Steps 5 and 6: verify and report

An update only counts as done once it is demonstrably active on the device. A short monthly report creates transparency for IT and management and shows where action is needed. It should contain at least these points:

• Share of devices that are fully patched, broken down by workstations, servers and network devices
• Open critical and actively exploited vulnerabilities, with their age in days
• Devices that have not checked in with the management tool for some time
• Approved exceptions and end-of-life systems with expiry dates

Regular vulnerability scans complement the report because they also find devices that are missing from the inventory.

Conclusion: consistency matters more than tools

Patch management is routine work that only pays off if it is done reliably every month. Whether you handle it internally or outsource it depends on the time and expertise in your team. Our article on when to outsource managed security services helps with that decision. Q-entra can take over ongoing patch and update management with managed security and, as part of cyber security, helps you set up the inventory, priorities and processes properly from the start.