“Restart later” needs a deadline: why patch management matters for your business

“Restart later” has probably had more clicks than anything I have ever posted on LinkedIn.

It is easy to understand why. You are finishing a quote, submitting payroll or preparing something for tomorrow’s lesson. The computer is working. An update feels like an interruption to the job that matters – so it waits.

The problem comes when nobody knows how long it has been waiting, whether the update eventually installed, or whether that version of the software still receives security fixes at all.

Good patch management helps protect the working day that depends on those systems. It gives someone responsibility for keeping updates moving and dealing with the exceptions before they become a bigger problem.

What CISA’s vulnerability review tells us

The US Cybersecurity and Infrastructure Security Agency’s Vulnerability Review for fiscal years 2024 and 2025, published in August 2026, describes a familiar pattern: opportunistic attackers finding and exploiting known weaknesses in systems exposed to the internet.

The report also highlights continued use of unsupported software. In its scanning findings for those years, 51% of scanned entities ran unsupported software. That figure comes from CISA’s scanning programme; it is not a survey of UK small businesses or schools. These findings appear on printed pages 1 and 18 of the report.

For an organisation in Chesterfield, Sheffield or Mansfield, the practical lesson is straightforward. Knowing what software you have, whether it is supported and which fixes are outstanding gives you something useful to act on.

You cannot control which organisations criminals scan next. You can reduce the opportunities they find in yours.

Windows Update is only part of the picture

A laptop can be up to date with Windows patches while other applications still need attention.

Think about the browser, PDF reader, meeting software and utilities installed to open a particular type of file. Each has its own update arrangements. Some update themselves reliably. Others need configuration, permissions or a restart. An application nobody remembers installing can easily escape attention.

A useful patching process therefore starts with an inventory: the devices you manage, the software installed on them and the versions in use.

It then checks what happened after an update was offered. Did it install successfully? Is a restart outstanding? Has the laptop been switched off or away from the management system for weeks?

Sending an update and confirming it worked are separate jobs. Both need an owner.

“It still works” tells you very little about support

Old software can keep doing its job after the supplier has stopped maintaining it.

The accounts package opens. The documents are accessible. Everyone knows where the buttons are. Replacing it costs money and takes time, so keeping it feels sensible.

But continued usefulness does not mean newly discovered security problems will be fixed.

This calls for a plan. Depending on the system, that might mean upgrading, replacing it, removing an application nobody needs, or restricting access while a replacement is arranged. Temporary restrictions need a review date too.

No patch management tool can install a security fix that the supplier no longer provides.

Windows 10 has reached end of support. Some Windows 11 versions have too.

Windows 10 version 22H2 reached the end of standard support on 14 October 2025. Eligible devices enrolled in Microsoft’s Extended Security Updates programme can continue receiving qualifying security fixes. ESU does not restore full product support, and specialist long-term servicing editions have their own lifecycles. See Microsoft’s Windows 10 ESU guidance.

Windows 11 also needs checking. Its individual releases have support deadlines, which differ by edition.

These examples apply as of 6 September 2026:

Sources: Microsoft’s Home and Pro lifecycle, Enterprise and Education lifecycle and Windows 11 release information. Specialist LTSC editions have separate dates. Pro Education follows the Home and Pro schedule, despite having “Education” in its name.

On a Windows computer, press Windows key + R, type winver and press Enter to check the version and edition.

Once a release reaches end of servicing, staying on it means losing regular operating system security fixes. Moving to an appropriate supported release is a different task from installing that release’s monthly patches. Compatibility, drivers and application requirements need checking as part of the upgrade plan.

Simply recording “Windows 11” in your asset list misses information that matters.

Fix the most important gaps first

CISA’s report recommends prioritising vulnerabilities according to real exposure and exploitation, rather than severity scores alone. Its Known Exploited Vulnerabilities catalogue identifies flaws with evidence of exploitation. The report urges immediate remediation and investigation for signs of compromise where those flaws are exposed to the internet. See printed pages 6 and 16.

For a business owner, that translates into useful questions:

• Which outstanding weaknesses are attackers already exploiting?

• Can the affected systems be reached from the internet?

• What would an attacker gain, and which services could be disrupted?

• Who is taking action, and by when?

Routine maintenance windows help keep disruption manageable. Urgent vulnerabilities need a route for faster action. Where testing or a compatibility problem delays a fix, the reason, temporary protection and next review should be recorded.

Patching also needs to sit alongside wider maintenance. Routers, firewalls, websites and specialist equipment may require separate updates or supplier involvement. Installing a patching agent on laptops does not automatically cover them.

Make the process fit the people using it

After around 20 years working alongside schools, I understand how quickly routine maintenance competes with everything else.

September brings new starters, leavers, classroom moves, password resets and devices returning after weeks switched off. A laptop can start perfectly well while still needing several updates and a restart.

Small businesses face their own version of this. The person chasing invoices may also be expected to chase software updates.

Staff need sensible notice, clear restart arrangements and somewhere to report a problem. The person managing updates needs to follow up failed installations and devices that have stopped reporting.

That is a more reliable arrangement than expecting every employee to judge the urgency of every update prompt while doing their main job.

How Heimdal, Nest Protect and Cygnet Shield help

At Black Swan, we use Heimdal Patch & Asset Management to help automate operating system and supported third-party application updates, schedule maintenance and provide visibility of software and patching gaps.

We agree what is covered and identify anything needing separate attention. Version upgrades and unsupported systems may require additional planning.

For organisations wanting broader device protection, patching is also included in our packages:

These controls reduce everyday opportunities for attacks. Backups, account security and any requirement for round-the-clock detection and response still need their own consideration.

We can work alongside your existing IT provider, with clear responsibilities for who manages what.

A sensible next step

Ask whoever manages your IT to show you which devices and applications are out of support, which important updates remain outstanding and who is resolving them.

A clear answer gives you a starting point. If the answer is uncertain, that is a useful gap to address.

Black Swan helps schools, small businesses, charities and local organisations across Derbyshire, South Yorkshire and North Nottinghamshire make this manageable.

Book a free 30-minute cyber security consultation. We will look at your current arrangements and help you decide what needs attention first.

“Restart later” is understandable. Leaving it there indefinitely needs a better plan.