Last updated: 7 November 2026
Apply critical and high-risk security updates as soon as you can, and always within 14 days of release. That 14-day limit is a Cyber Essentials requirement and applies to operating systems, applications, browsers, firewalls and routers. Automate patching and check it is working every week.
What to patch, and how fast
| System | Target | How |
|---|---|---|
| Windows and macOS | Within 14 days (critical sooner) | Automatic updates, managed centrally |
| Browsers and apps | Within 14 days | Managed deployment and auto-update |
| Firewalls and routers | Within 14 days of fixes for high-risk flaws | Scheduled firmware checks |
| Servers and websites (including WordPress and PHP) | Within 14 days, test first | Maintenance windows and backups |
| Unsupported software | Cannot be patched | Upgrade or replace |
Why patching matters
Exploited vulnerabilities are the second most common way in, at 20% of breaches in Verizon’s 2025 report, and attackers move within days of a flaw becoming public. Our PHP security alert shows how quickly a fix becomes urgent.
How ABCOM helps
Patching is part of our managed IT plans, and a vulnerability assessment shows what is exposed today.
Quick answers
What if a patch breaks something?
Test on a pilot group first and keep backups, but do not skip the update. Delaying critical fixes for weeks costs far more than the occasional compatibility issue.
Not sure everything is patched? A vulnerability assessment shows exactly what is exposed.
Related answers and guides
- What happens when software reaches end of life?
- Why do businesses fail Cyber Essentials?
- Critical PHP security alert
- Vulnerability assessment
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about cyber security services. Free, friendly and no obligation.