Skip to content
Cyberschutz.io

Prioritising security updates: what small businesses should patch first

Can’t update everything at once? A clear prioritisation by exploitation, exposure and criticality – plus how to handle legacy systems.

Checked on · Cyberschutz.io editorial team

Contents

Short answer

Start with vulnerabilities that are already being actively exploited and with systems reachable from the internet – such as firewalls, VPNs and remote access. Then central identity and administration systems, servers with important data, frequently used applications and endpoints. The order is a guide: what decides is actual exploitability, exposure, criticality and existing protection.

First the overview, then patching

Why inventory comes first

You can’t sensibly update what you don’t know about. The BSI advises SMEs to know their IT systems and to assign responsibilities clearly.

A minimal overview

A simple table is enough: device or system, software, version, owner, reachable from the internet yes/no, vendor support available, criticality, last update status. You don’t need a complex asset management system.

Prioritisation as a guide

  • 1. Actively exploited critical vulnerabilities
  • 2. Publicly reachable systems such as website, shop or mail server
  • 3. Firewalls, VPNs, gateways and remote access
  • 4. Central identity and administration systems
  • 5. Servers with critical business data
  • 6. Browsers, email clients and frequently used applications
  • 7. Endpoints
  • 8. Less critical internal systems
  • No fixed ranking: an internal system with an actively exploited flaw can be more urgent than a well-protected public one.

Step by step

  1. 01

    Create an inventory

    Record systems and software with the fields above. Start with everything reachable from the internet.

  2. 02

    Assign responsibility

    Every system needs a person or service provider responsible for updates.

  3. 03

    Use automatic updates

    Turn on automatic updates where possible. That leaves time for the systems that need manual work.

  4. 04

    Follow security advisories

    Subscribe to advisories from the vendors of your most important systems and from the BSI.

  5. 05

    Install by urgency

    Actively exploited and publicly reachable systems first, then the rest by criticality.

  6. 06

    Check the result

    Verify that the update is actually installed and record the status.

What if there are no more security updates?

Systems without vendor support stay permanently vulnerable. Options to check, in this order:

  • Replace – the permanent solution
  • Upgrade to a supported version where possible
  • Isolate temporarily, for example without direct internet access
  • Limit access to the essentials
  • Document the interim solution with an end date
  • Isolation is an interim measure, not an equivalent permanent substitute for security updates.

Checklist

  • A simple inventory with version, owner and exposure exists.
  • Every system has a responsible person or provider.
  • Automatic updates are on where possible.
  • Publicly reachable systems and remote access are updated first.
  • Legacy systems without support are known and have a replacement plan.
  • Update status is documented.

Common mistakes

  • Patching without an overview and missing important systems.
  • Forgetting firewall, VPN or router because they “just run”.
  • Applying a fixed ranking rigidly without checking exploitation and exposure.
  • Running legacy systems isolated indefinitely without planning a replacement.
  • Not checking whether updates were really installed.

Frequently asked questions

What matters more: servers or laptops?

It depends. Publicly reachable systems and those with actively exploited flaws usually come first; endpoints are numerous and still important.

How quickly should updates be installed?

The BSI recommends installing security updates promptly. Specific deadlines can follow from contracts, insurance conditions or your risk.

Do we need an asset management system?

Not to start with. A maintained table with the key fields is enough for many small businesses.

What is the CISA KEV catalog?

A list of vulnerabilities known to be exploited. It helps with prioritisation but doesn’t replace your own assessment.

Can we just disconnect an old system from the internet?

As an interim step it can reduce risk. Permanently, it doesn’t replace security updates.

Sources

Checked on 7 October 2026.

This content is for general guidance. No measure guarantees that an attack or outage is prevented.

Read next