Patch Management for Small Businesses
Not every vulnerability deserves the same level of panic.
Small businesses are often told to “patch faster”. It sounds sensible, but it does not tell you what to patch first, what can wait, what has failed, or whether attackers are actually using a vulnerability in the real world.
Good patch management is not about staring at a long list of scary scores. It is about knowing what you have, fixing what matters, removing what should not be there, and keeping evidence that updates are actually being managed.
A vulnerability score tells you how bad something could be. It does not always tell you whether attackers are actually using it against businesses like yours.
What is patch management?
Patch management is the process of finding, testing, installing and checking software updates across your devices and applications. That includes Windows updates, third-party applications, browsers, PDF tools, remote access software, drivers and other software your business relies on.
For a small business, patch management should answer simple questions:
What do we have?
You cannot reliably patch laptops, desktops or servers if you do not know they exist.
What is installed?
Old, unwanted or unsupported software often creates risk quietly in the background.
What is missing?
Missing patches need to be visible, prioritised and followed up.
What can we prove?
Cyber Essentials, SMB1001, insurers and clients may all ask for evidence that patching is managed.
You cannot patch what you cannot see. Asset visibility and patch management belong together.
Why “patch everything immediately” is not always helpful advice
In an ideal world, every device and every application would be patched instantly with no disruption. In the real world, small businesses have limited time, limited people, remote devices, business-critical systems and software that may need testing before updates are applied.
The answer is not to ignore patching. The answer is to make better decisions.
- Know what you have. Start with devices, software, versions and systems that have not checked in.
- Remove unsupported software. Old software that no longer receives security updates should not be left hanging around.
- Automate routine updates. Common updates should not rely on memory, spreadsheets or someone finding time later.
- Prioritise known exploited vulnerabilities. If attackers are actively using it, it needs attention quickly.
- Test where needed. Some updates need a careful rollout, especially on business-critical systems.
- Check failed updates. Downloaded does not always mean installed. Installed does not always mean successful.
- Keep evidence. Being patched is useful. Being able to show it is even better.
What CVSS tells you
CVSS stands for Common Vulnerability Scoring System. It gives vulnerabilities a score to help describe technical severity. A higher score usually means the vulnerability could have a more serious impact if exploited.
How severe it could be
CVSS helps show whether a vulnerability could lead to serious outcomes such as remote code execution, privilege escalation or data exposure.
How easy it may be to exploit
The score can consider technical factors such as attack complexity, access required and whether user interaction is needed.
How to compare findings
CVSS gives teams a common language for comparing vulnerabilities across systems, tools and reports.
CVSS is useful. It helps you understand potential impact. But it is only one part of the decision.
What CVSS does not tell you
A high score does not automatically mean a vulnerability is being used by attackers against businesses like yours today. It also does not tell you whether the affected software is installed in your business, exposed to the internet, protected by other controls, or sitting on a system that matters.
It does not always show real-world exploitation
A vulnerability may be technically serious, but not widely exploited. Another may have a lower score but be actively used by attackers.
It does not understand your business
CVSS does not know whether the affected system runs payroll, stores care records, supports teaching, processes invoices or sits unused in a corner.
It does not prove exposure
A score does not tell you whether the vulnerable system is internet-facing, protected, segmented, rarely used or already decommissioned.
It does not check whether you can fix it safely
Some updates are straightforward. Others need testing, downtime planning or a replacement project if the software is unsupported.
A vulnerability score tells you how bad something could be. It does not always tell you whether attackers are actually using it, whether it affects you, or what you should fix first.
Why known exploited vulnerabilities matter
Known exploited vulnerabilities are vulnerabilities that attackers are already using in the real world. For small businesses, this matters because criminals often look for easy wins. They do not need to invent a new attack if an old, unpatched weakness still works.
This is where patching becomes more practical. Instead of treating every warning as equally urgent, you can ask better questions.
Is it being exploited?
If attackers are already using it, it deserves more attention than something that is only theoretically possible.
Do we have the affected software?
This is why asset and software visibility matters. You cannot prioritise properly if you do not know what is installed.
Is it exposed?
An internet-facing system, remote access tool or widely used browser may need faster action than an isolated internal system.
Known exploited beats theoretically scary. If criminals are already using it, do not let it sit in the queue behind routine updates.
Why business context matters
Two businesses can have the same vulnerability and face very different levels of risk. A care provider, school, accountant, trades business and charity may all use similar devices, but the impact of downtime, data loss or account compromise can be very different.
What would stop working?
If this system fails or is compromised, does it stop invoicing, teaching, care delivery, payroll, bookings or access to client data?
Who can reach it?
Internet-facing systems, remote access tools and heavily used applications usually need closer attention.
Who will ask?
Cyber Essentials assessors, SMB1001, insurers, clients, supply chains and regulators may all want to know how updates are managed.
Patching is not just a technical job. It is a business risk decision.
How small businesses can prioritise patching without getting overwhelmed
You do not need to build an enterprise vulnerability management programme on day one. You need a simple, repeatable process that reduces obvious risk and gives you better evidence over time.
Start with visibility
- List your devices
- Check what software is installed
- Find unsupported applications
- Spot devices that have not checked in
- Check whether updates are actually completing
Then prioritise sensibly
- Fix known exploited vulnerabilities quickly
- Prioritise internet-facing systems
- Patch browsers and common third-party apps
- Remove software nobody needs
- Keep reports for evidence
Progress beats panic. A basic patching process that is followed every month is better than a perfect spreadsheet nobody opens.
How patching supports Cyber Essentials and SMB1001
Patch management matters because many compliance schemes expect supported software, timely updates and sensible evidence that devices are being maintained. Tools do not give you compliance on their own, but they can make the evidence easier to collect and the process easier to manage.
Supported software and security updates
Cyber Essentials expects organisations to keep software supported and apply important security updates. Good patch management helps show this is being handled properly.
Ongoing cyber hygiene
SMB1001 is about sustainable, practical cyber security for smaller businesses. Patch management supports the ongoing governance and evidence behind that.
“We think updates happen automatically” is not strong evidence. “Here is what is installed, what is patched, what failed and what we did next” is much better.
Action1 or Heimdal Patch & Asset Management?
The right option depends on what problem you are trying to solve. Some businesses need a focused patch management platform. Others need patching to sit inside a wider endpoint security package.
Action1 Patch Management
Action1 may be a good fit if you want a focused cloud-based patch management platform, clearer reporting, remote endpoint management and a practical way to get patching under control.
It is especially interesting for smaller organisations because Action1 offers a free tier for up to 200 endpoints.
Explore Action1 Patch Management →Heimdal Patch & Asset Management
Heimdal may be a better fit if you want patching and asset visibility to sit alongside wider endpoint security controls, such as NGAV, DNS security, ransomware encryption protection or managed detection and response.
It works well when patching is part of a broader cyber security package, not a standalone job.
Explore Heimdal Patch & Asset Management →The question is not “which tool is best?” The better question is “what are we trying to fix: patching alone, or endpoint security as a whole?”
A simple small business patch management checklist
Every month
- Review missing operating system updates
- Review third-party application updates
- Check failed updates
- Check devices that have not reported in
- Remove software that is no longer needed
Every quarter
- Review unsupported software
- Check patching evidence for Cyber Essentials or SMB1001
- Review internet-facing systems
- Check high-risk and known exploited vulnerabilities
- Update your patching process if something keeps failing
Where patch management fits in the bigger picture
Patching is important, but it does not replace wider cyber security. A fully patched device can still be compromised by phishing, stolen passwords, poor configuration, weak MFA, malicious email or lack of backup.
Heimdal NGAV
Strengthen endpoint protection alongside patching and software visibility.
Managed EDRHuntress EDR
Human-led 24/7 managed detection and response for endpoint threats.
ComplianceCyber Essentials
Show customers and suppliers that key cyber security controls are in place.
Small BusinessCyber security basics
A plain-English guide to the controls small businesses actually need.
Patch management FAQs
What is patch management in simple terms?
Patch management is the process of keeping devices and software up to date, checking failed updates, removing unsupported software and keeping evidence that updates are being managed.
Why are automatic updates not enough?
Automatic updates help, but they may not cover every third-party application, unsupported software, failed update, remote device or evidence requirement. Proper patch management gives better visibility and control.
What does CVSS tell me?
CVSS helps describe the technical severity of a vulnerability. It tells you how bad something could be, but not always whether attackers are using it against businesses like yours.
Should small businesses patch every critical vulnerability first?
Critical vulnerabilities need attention, but prioritisation should also consider whether the vulnerability is known to be exploited, whether you use the affected software, whether the system is exposed, and how important it is to your business.
How does patch management help with Cyber Essentials?
Cyber Essentials expects supported software and timely security updates. A patch management process helps you find missing updates, deal with unsupported software and provide better evidence.
Which is better, Action1 or Heimdal Patch & Asset Management?
Action1 is a strong option for focused patch management, especially with its free tier for up to 200 endpoints. Heimdal may be better when patching needs to sit inside a wider endpoint security package. The right answer depends on your business, tools and risk.
Need help getting patching under control?
If you are not sure what is installed, what is missing, what has failed or what you could prove during a Cyber Essentials, SMB1001, insurance or supplier review, we can help.
We help small businesses, schools, care providers, charities and local organisations make patch management practical, proportionate and easier to evidence.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!