What an update actually changes
Software is written by people, and large programs contain mistakes. Some mistakes are cosmetic. Others are security flaws, called vulnerabilities, which could let an attacker run code on your device, read data they should not see or take over an account. When researchers, the vendor or sometimes an attacker find one, the vendor writes a fix and releases it as an update, often called a patch.
Updates are not only about security. They also fix crashes, add features and improve compatibility. But the security portion is the reason to treat them as routine maintenance and not optional extras.
How a hole becomes a problem
The key point is timing. Once a patch is released, the flaw it fixes becomes public knowledge, at least in outline. Attackers can study the fix to work out what was wrong, and some build tools to take advantage of machines that have not installed it yet. Someone who patches promptly is protected. Someone who waits is a target for a flaw that is now well known.
Security people also talk about “zero-day” flaws, meaning ones attackers use before a fix exists. Updates cannot help against those until a patch arrives, which is one more reason to install them quickly when they do.
Automated attacks do not choose victims by importance. They scan for devices with known weaknesses, so an ordinary home computer can be hit simply because it is out of date. This is part of general online safety: current software removes many of the easiest routes in.
What needs updating
The operating system gets the most attention, but it is not the only thing.
- Operating system. Windows, macOS, Linux, Android and iOS all receive security patches. On phones, the differences between platforms are covered in the article on mobile operating system updates.
- Web browsers. Browsers handle untrusted content all day, so they are a frequent target. Most update themselves, but a restart is sometimes needed to finish.
- Browser extensions and plugins. A browser extension has wide access to what you view, so keep extensions updated and remove ones you no longer use.
- Applications. Office suites, PDF readers, media players and chat apps all have flaws from time to time.
- Router and other devices. Home routers, printers, smart-home gadgets and similar devices run software too, and are often forgotten. Check the maker’s instructions for how updates are delivered.
- Firmware and drivers. These are lower-level programs for hardware, and the maker often supplies updates for them as well.
Why people delay, and what it costs
Common reasons for putting updates off are interruptions, fear that something will break, and the slow speed of some installs. These concerns are understandable. Occasionally an update does cause a problem, and big feature updates are more likely to than small security ones.
But the usual cost-benefit balance favours updating. A few minutes of restart time is small next to the risk of an unpatched flaw. If you are worried about something breaking, make sure your files are protected first. A current backup, as described in the article on data backup and recovery, turns a failed update from a disaster into an annoyance.
If you work in a setting where a failed update would cost real money, such as a small business, it is reasonable to wait a few days after a major release while still installing security patches soon. For most home users, waiting longer than that mainly adds risk.
Making updates easy
- Turn on automatic updates for the operating system, browser and applications that support them.
- Restart when asked. Many patches do not take effect until the computer restarts, so postponing a restart for weeks leaves the fix unused.
- Check manually now and then. Open the update section in system settings, and check the apps that do not update themselves.
- Use official sources. Download updates from the system’s own updater, the official app store or the maker’s website.
- Keep a record of devices. Note which gadgets in your home need occasional updates and when you last checked.
Fake update warnings
Criminals know that people expect update prompts. Be wary of pop-ups in a web page that claim your browser or media player is out of date and urge you to download something. A real update comes through the program itself or the system settings, not through a banner on an unrelated site. Such lures also appear in tech support scams and in phishing emails that carry fake “update now” links. If in doubt, close the page, open the application or settings directly and check there.
When updates stop
Every product has a support period. After it ends, the vendor stops releasing security fixes, and newly discovered flaws stay open. Using an unsupported operating system or a very old phone becomes riskier over time, even with careful habits. Check the support dates for your devices, and plan for replacement or an upgrade to a supported version before they run out. If you must keep an old machine for a specific purpose, limiting what it does and keeping it off the internet where possible reduces the exposure.
What updates do not do
Staying current is one layer of protection, not a complete defence. It does not stop you being fooled into giving away a password, which is why habits like two-factor authentication and a password manager still matter. It also does not remove the effect of past data breaches. Think of updates as the baseline that makes everything else work better.