Why updating matters so much
Getting a program from the right place is only the start. Over time, flaws are found in almost all software, and attackers look for devices that have not been fixed. CISA describes patches as software and operating system updates that address security vulnerabilities, and notes that attackers may target a vulnerability for months or even years after an update for it has been released. Its conclusion is that keeping software up to date is the most effective measure you can take to protect your computer, phone and other devices.
The UK National Cyber Security Centre makes the same point for home users: updates include protection from viruses and other malware, as well as improvements and new features, and applying them is one of the most important and quickest things you can do to stay safe online. If you get a prompt to update, it says, do not ignore it. NIST's guidance for organisations frames patching in the same spirit, as routine preventive maintenance rather than an occasional chore.
CISA's Secure Our World campaign adds that updates should cover everything: the operating system, programs and apps, and in particular web browsers and antivirus software.
Turn on automatic updates
Every source behind this guide gives the same first step: let updates install themselves.
- CISA recommends enabling automatic updates whenever possible, so updates are installed as quickly as possible, and checking the vendor's website yourself where automatic updates are not offered.
- The NCSC says to turn on automatic updates in your device's settings, if available, so you do not have to remember.
- The FTC advises setting your phone to update automatically, and updating your apps too.
CISA's campaign material goes further and says every product you use should have automatic updates turned on by default; if one has no automatic option, it suggests asking the provider why not. It also warns against the habit of choosing "Remind me later" on update alerts, since many updates exist to fix security risks.
Where the update settings are
The operating system makers document where to find updates. Menu names change between versions, so if these do not match your screen, search your device's settings for "update".
Windows
Microsoft's Windows Update FAQ says to open Start, then Settings, then Windows Update to see your update status and available updates, and to choose Check for updates. Microsoft explains that you cannot stop updates entirely, because they help keep the device secure; you can pause them for a limited time, after which the latest updates must be installed before you can pause again. To finish installing, Windows needs to restart, and you can set active hours or schedule the restart.
Mac
Apple's support page says to use Software Update, found in System Settings under General, to keep a Mac up to date. Software Update checks automatically for new Apple software compatible with your Mac; to check again, choose Check for Updates. Apple recommends backing up before installing new software, asks for your administrator password before installation, and says to let installation finish without putting the Mac to sleep or closing its lid. Apple also recommends using the latest macOS that is compatible with your Mac.
Phones and other devices
The NCSC points readers to the support area of each manufacturer's official website for detailed instructions, for phones, tablets and computers and for smart devices such as speakers, fitness trackers and cameras. The FTC reminds phone users that operating system updates often include critical patches and protections against security threats.
Programs you installed yourself
Apps from an official store are usually updated by the store. Programs from a package manager are updated by the same tool, for example with WinGet's upgrade command on Windows or APT on Debian-based Linux. Programs installed from a vendor's site may update themselves or may need you to check the vendor's site, which is where CISA says vendors usually put updates.
Fake update prompts
Because people are told to install updates promptly, a fake update is an effective disguise. CISA warns that attackers have used email messages to send people to websites hosting malicious files disguised as legitimate updates, and that an email claiming to attach a software update may contain malware. Its advice: only download software updates from trusted vendor websites, and do not trust a link in an email.
The same applies to a web page that suddenly says your browser or a media player is out of date and offers a download. Genuine updates arrive through the update mechanism of the software or the operating system, or from the vendor's own site reached by typing its address. Close the page, then check for updates the normal way. If the software really is out of date, it will say so there.
Rule of thumb
An update you did not go looking for, arriving by email, message or a pop-up on a web page, is not an update. Check through the device's own settings instead.
When and where to update
CISA suggests applying updates, where possible, from networks you trust, such as home or work, and avoiding updates on untrusted networks such as those in airports, hotels or coffee shops. If you must update on one, it suggests first connecting through a virtual private network to a trusted network. The NCSC notes that updating can take some time and needs a reliable connection, so home, on your own Wi-Fi and with the device plugged in, is the best place to do it.
Example: an update routine
This is an invented example and describes no real person or device. A household has a Windows laptop, a Mac and two phones. On each, automatic updates are switched on in the system settings. Once a month, on a weekday evening at home, someone opens the update screen on each device to confirm it says it is up to date, runs the package manager's upgrade command for programs installed that way, and checks that the phones' app stores have no updates waiting. Anything that has not updated in months is looked up on the maker's site to see whether it is still supported.
When updates stop: end of life
Sooner or later every program and device stops getting updates. CISA calls this end-of-life (EOL) software: the vendor has stopped supporting the program or issuing updates for it. Continuing to use it, CISA says, poses a real risk because security flaws found after that point will not be fixed. Its recommendation is to retire end-of-life products and not to use unsupported software.
The NCSC says the same about devices. Manufacturers eventually stop providing updates for older devices, and a device that is no longer supported will not get security updates, leaving it less secure. It adds that you do not need the latest or most expensive model to stay safe, but advises against buying or using phones that are no longer supported, and suggests checking online whether a specific model still receives updates from its manufacturer. Microsoft makes a similar point for Windows: to receive monthly updates, you must be on a supported version.
Practical steps when something reaches end of life. They follow from CISA's advice to retire end-of-life products; no single source sets them out as a list:
- Check the maker's site for a supported version or a successor, and move to it.
- If there is none, look for a supported alternative in an official store or your package manager.
- If you must keep an old device for a while, avoid using it for banking, email or anything sensitive, and do not install new software on it from outside an official store.
In short
- Turn on automatic updates everywhere they exist, including apps, browsers and security software.
- Install prompted updates soon, at home on a trusted network.
- Ignore update offers that arrive by email, message or web page; check in settings instead.
- Know when your software and devices reach end of life, and plan to replace them.