Every week, software vendors publish fixes for security flaws. Every week, attackers read those same announcements and race to find businesses that haven’t installed the fix yet. That gap, between “patch released” and “patch installed,” is where a large share of real-world breaches happen.
For a 15-person law firm in Tyler or a manufacturing shop in Longview, patching can feel like an endless chore that always loses to the day’s actual work. This guide breaks it down into a routine you can run without a full-time IT department.
What “patching” actually means
A patch is a software update that fixes a bug, and many of those bugs are security holes. Patching covers more than Windows updates. A complete picture includes:
- Operating systems: Windows, macOS, and the Linux or embedded systems that run servers and equipment.
- Business applications: Microsoft 365 desktop apps, accounting software, practice-management and line-of-business tools.
- Browsers and plug-ins: Chrome, Edge, Firefox, and PDF readers.
- Network devices: Firewalls, routers, switches, and Wi-Fi access points. These are patched less often than laptops and are a favorite target.
- Remote-access tools: VPN appliances and remote support software, which sit directly on the internet.
- Websites and plug-ins: If you run WordPress or another CMS, the core software, themes, and plug-ins all need updates.
Why attackers love unpatched systems
Exploiting a known flaw is cheaper than inventing a new attack. Once a vulnerability is public, automated scanners sweep the internet for vulnerable systems within hours or days. The attacker doesn’t need to know who you are. They only need your system to match.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintains a public list of vulnerabilities known to be actively exploited, called the Known Exploited Vulnerabilities (KEV) catalog. It is one of the most useful free tools a small business can pay attention to, because it separates “theoretical” risk from “being used against organizations right now.”
Step 1: Build an inventory
You can’t patch what you don’t know you have. Start with a simple spreadsheet listing:
- Every computer, server, and mobile device
- Every network device, including that firewall installed years ago
- Every business application and who uses it
- Any internet-facing system (VPN, remote desktop, web server, camera recorders)
Include equipment tied to your operations. Manufacturers and oilfield or timber suppliers often have industrial controllers and workstations that run older software. Those systems need a documented plan even if they can’t be updated on the normal schedule.
Step 2: Set patch timelines by risk
Not every update is equally urgent. A tiered policy keeps the team from either panicking over everything or ignoring everything:
- Actively exploited or critical, internet-facing: Patch within 48-72 hours. If a vendor says attacks are underway, treat it as an emergency.
- High severity: Patch within 14 days.
- Medium and low severity: Patch within 30 days, usually in a regular monthly cycle.
- Feature updates: Schedule and test them. They are rarely urgent.
Microsoft releases security updates on the second Tuesday of each month (“Patch Tuesday”). Many businesses build their routine around it: test in the first week, deploy in the second, verify in the third.
Step 3: Automate what you can
Manual patching fails when people get busy. Automate the safe parts:
- Turn on automatic updates for browsers and productivity software.
- Use a management tool to push operating system updates on a schedule, with maintenance windows after hours.
- Enable automatic updates on firewalls and access points where the vendor supports it, or put a recurring calendar reminder in place when it doesn’t.
- Enroll laptops that leave the office so they get updates anywhere, not only on your network.
Automation doesn’t remove the need for oversight. You still need a report showing which devices are behind.
Step 4: Test before you roll out broadly
Occasionally an update breaks something. A small pilot group, such as two or three machines that represent your typical setup, catches most problems before they reach everyone. Keep a current backup before major updates. If you haven’t tested your restores recently, our guide to ransomware-proof backups covers how to do it.
Step 5: Verify and document
“We deployed it” is not the same as “it installed.” Check reports for failed installs, machines that were off during the maintenance window, and devices that need a reboot to finish. Keep a short record of what was patched and when. This matters beyond security: HIPAA, the FTC Safeguards Rule for CPAs and dealerships, and cyber insurance applications all ask how you manage updates.
What to do when you can’t patch
Sometimes an update isn’t possible because the vendor no longer supports the product, or the equipment runs software that can’t be changed. When that happens:
- Isolate it. Put the system on its own network segment with strict rules about what can reach it.
- Limit exposure. Never leave it directly reachable from the internet.
- Monitor it. Watch for unusual traffic or logins.
- Plan the replacement. Put an end-of-life date on the calendar and budget for it.
Patching across East Texas industries
Different local businesses carry different patching risks:
- Healthcare practices in Tyler and Lufkin often run older clinical software tied to specific operating system versions, and HIPAA expects documented vulnerability management.
- Manufacturers and suppliers in Longview and Texarkana may have shop-floor systems that can’t be rebooted mid-shift, so patch windows need to be planned with production.
- Defense contractors pursuing CMMC compliance must show a consistent flaw-remediation process.
- Law firms and CPA offices hold sensitive client data and often rely on one or two internet-facing tools for remote access, exactly the type attackers scan for first.
- Dealerships run dealer-management systems and many connected devices, all of which need to be accounted for.
A simple weekly routine
If you do nothing else, build this into your week:
- Check vendor and CISA alerts for anything affecting your inventory.
- Review the patch compliance report and chase the machines that are behind.
- Confirm internet-facing systems (firewall, VPN, remote support tools) are current.
- Reboot machines that are waiting on updates.
Thirty focused minutes a week beats a frantic weekend after an incident.
Need help staying current?
Most small businesses don’t have anyone whose job is to track patches, and that’s a reasonable place to get outside help. Dogwood Security’s managed IT services include patch management, monitoring, and reporting, and our cybersecurity team can assess where your biggest exposures are. If you’re looking for managed security services in Tyler, TX or elsewhere in East Texas, get in touch and we’ll walk through your environment with you. You can also see how we serve local businesses on our Tyler, TX page.
This Week in Security
A look at notable stories from the past seven days, with a focus on what matters to small and mid-sized businesses.
CISA confirms attacks on PHP flaws chained with firewall bug (Oct 26)
CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming in-the-wild exploitation. Researchers at Dream found the PHP bugs chained with a Palo Alto Networks firewall flaw to compromise 25 servers, at least one linked to the U.S. government. Takeaway: PHP powers a large share of business websites, and internet-facing firewalls are prime targets. Confirm both are patched. Sources: The Record, CISA alert.
Web hosts hit by incidents (Oct 28)
DreamHost forced email and FTP/SFTP password resets after a security incident, since resolved. 123-Reg disclosed an AI-driven attack that scraped customer contact information and suspects a China-nexus actor. Takeaway: If your website or email is hosted with a provider, a provider breach is your problem too. Watch for phishing that references your hosting account. Sources: BleepingComputer, The Register.
Bank of America warns customers about AI assistants (Oct 27)
The bank asked customers not to share banking passwords with AI assistants or agents. Takeaway: Add AI tools to your acceptable-use policy. Credentials should never be pasted into a chatbot or handed to an automated agent. Source: TechCrunch.
Applebee’s app exposed customer data (Oct 30)
A hardcoded database password left in the restaurant chain’s app exposed customers’ personal data on the web. Takeaway: A reminder that secrets embedded in code or apps get found. If you build or buy custom software, ask how credentials are stored. Source: TechCrunch.
We didn’t find a major new Texas-specific incident reported this week. Texas businesses can track state-level breach notices through the Texas Attorney General’s data breach report.