When I talk to school leaders about cyber security, patching rarely gets anyone excited. It tends to sit somewhere between safeguarding audits and GDPR paperwork on the list of things people know are important but would rather not think about.
The challenge is that patching has become one of the most important cyber security controls schools have.
The Department for Education expects high-risk vulnerabilities to be addressed within 14 days of a fix being released. That includes security patches, configuration changes and vendor-provided fixes where a vulnerability is rated Critical, High, or has a CVSS score of 7.0 or above.
On the face of it, that sounds straightforward.
Install the updates. Problem solved.
Anyone who has worked in school IT knows it is rarely that simple.
I’ve seen updates affect printing, break integrations, cause issues with specialist education software and create unexpected problems during the school day.
The National Cyber Security Centre recognises this reality. Its guidance on patching highlights something many people overlook: patching itself carries risk.
Installing updates without understanding what they do can cause disruption. Delaying critical security updates can leave systems exposed. Schools are often caught somewhere in the middle.
The answer is not to patch everything immediately. The answer is to understand what matters most.
Not every update carries the same risk
A feature update that changes the appearance of an application is very different from a vulnerability that allows criminals to take control of a server.
That distinction is becoming increasingly important.
Recently, the US Cybersecurity and Infrastructure Security Agency (CISA) introduced new rules requiring some federal agencies to patch certain vulnerabilities within just 72 hours.
The interesting part is not the timeframe. It is how they decide what needs urgent attention.
Their focus is on vulnerabilities that are:
Exposed to the internet
Already being exploited
Easy to automate
Capable of giving attackers significant control
In other words, they are prioritising the vulnerabilities most likely to be used in real-world attacks.
The principle is exactly the same one schools should be following. Focus first on the issues most likely to cause harm.
The bigger problem nobody talks about
There is another point in the CISA guidance that deserves more attention.
Applying a patch does not necessarily remove an attacker.
If a vulnerability has already been exploited, installing the update closes the door.
It does not tell you whether somebody came through it last week.
An attacker may already have:
Stolen credentials
Installed malware
Created backdoor accounts
Accessed sensitive information
This is why cyber security cannot rely on patching alone.
Patching reduces risk.
Monitoring helps identify when something has already gone wrong.
Backups help you recover.
Staff awareness helps prevent attacks from succeeding in the first place.
Good cyber security is rarely about a single control.
It is about layers.
Why schools need visibility
One of the biggest challenges schools face is simply knowing what needs updating.
You cannot protect devices you do not know exist.
You cannot patch software you cannot see.
You cannot prioritise vulnerabilities if you have no visibility of them.
This is where patch and asset management tools have become increasingly useful.
Solutions such as Heimdal Patch & Asset Management or Action1 help IT teams identify devices, monitor software versions and deploy updates in a more controlled and consistent way.
They do not remove the need for judgement.
They simply make it easier to see what requires attention and reduce the risk of something important being missed.
For schools with limited IT resources, that visibility can make a significant difference.
The goal isn’t perfect patching
No school will ever have every device fully patched every minute of every day.
That is not a realistic target.
The goal is to identify the vulnerabilities that matter most, understand where the greatest risks exist and address them before attackers have the opportunity to exploit them.
The DfE’s 14-day requirement provides a clear benchmark.
The NCSC explains the practical challenges.
The schools that get this right are not necessarily patching faster than everyone else.
They are patching smarter.
Because when cyber criminals find an unpatched vulnerability, they are not interested in how busy the IT team has been.
They only care that the door was left open.
