Most of the SME breaches we get called to don't come from a brilliant attacker or a zero-day from the industry headlines. They come through a vulnerability whose patch has been publicly available for eight, eleven, sometimes seventeen months — only nobody installed it.
Patch management sounds boring. It is boring. And that's exactly why nobody handles it in an orderly way until the 6 a.m. phone call with "the whole company is down." This post is about how to keep a sensible update rhythm in a 10–50 person business — without expensive tools, without six-month rollouts, and without paralysing a team whose computers suddenly restart three times a day.
Why "we update quarterly" no longer cuts it
The most common patching policy we walk into at SMEs is "we patch when something breaks." The second most common is "once a quarter, during the maintenance review." Both were reasonable fifteen years ago. Today they're not enough, for three reasons.
First, the gap between a patch being published and a working exploit being available has shrunk drastically. A critical vulnerability in Microsoft Exchange, a SonicWall or Fortinet VPN typically has a working exploit circulating within 48–72 hours of the CVE. A quarter is an eternity to an attacker.
Second, ransomware-as-a-service has normalised mass scanning of the internet for unpatched systems. Your public mail server or firewall gets scanned dozens of times a day — not because someone hates you, but because it's on a list of IPs. An unpatched Exchange server in a 30-person firm looks just as juicy as one in a Fortune 500.
Third, vendors themselves have changed cadence. Microsoft ships Patch Tuesday every month, firewall vendors push out-of-band emergency patches, and NAS and printer vendors release firmware more often than they used to. "Once a quarter" means your network averages six weeks running with holes whose patch is already sitting on the shelf.
A concrete case — a 30-person wholesaler and an unpatched Exchange
One of our clients — a 30-person automotive parts wholesaler in central Poland — was hit by ransomware that came in through an Exchange server exposed to the internet (for remote mail access). It was missing a critical security patch from 11 months earlier. The vulnerability had been covered in trade press, the patch had been available for ages, but "there was never a window to restart the server."
The attacker encrypted the file server, the Comarch Optima database and — most painfully — the backups on a NAS the server had permanent SMB access to. The company stood still for 3 working days. Total cost — by the owner's internal estimate — exceeded 80,000 PLN (~18,500 EUR): lost orders, team overtime, consultancy work (including ours), new hardware and new licences. The ransom was not paid — recovery happened from an offline copy that was two weeks old, plus accounting documents recovered from PDFs in emails.
After the incident we rolled out a simple patch management process with them: a monthly window (Thursday 7:00–8:00 a.m.), 72-hour priority for critical patches, automatic updates on workstations, manual review on servers. Tool cost — 0 PLN (everything on built-in WSUS plus a PowerShell script). Administrator effort — about 4 hours per month. Over the following year the number of critical vulnerabilities on the network dropped from 47 to 3 (measured by a free external scanner).
This isn't a story about magic. It's a story about an hour a month costing 12 hours a year, while an unpatched server costs 80,000 PLN and a week of nerves.
What actually needs patching in an SME
In a typical 30-person company there are more layers that need patching than people realise. It helps to name them, because each has a different rhythm and a different method.
- Workstation operating systems (Windows 10/11). Patch Tuesday, the second Tuesday of the month. Ideally automatic, with a 3–7 day delay against the release date (so any faulty patches have time to be withdrawn).
- Server operating systems. Also Patch Tuesday, but manual and in a planned window. A server restart needs coordination.
- Firewall / edge router. Check monthly whether the vendor has released new firmware. Critical patches — within 72 hours.
- Hypervisor (VMware, Hyper-V, Proxmox). Quarterly, unless there's a critical CVE.
- Business applications — ERP, CRM, warehouse system. On the vendor's cycle. Comarch Optima ships monthly updates, Microsoft Dynamics AX quarterly, smaller systems irregularly. Worth tracking release notes here.
- Browsers and the office suite. Mostly automatic. Just verify auto-update for Chrome / Edge / Firefox is on for everyone.
- Hardware firmware — NAS, printers, access points, cameras. The most frequently forgotten layer. Quarterly review. A printer with four-year-old firmware is a very real entry route.
- Third-party software (PDF readers, graphics tools, Zoom, TeamViewer, AnyDesk). Adobe Acrobat and 7-Zip appear on vulnerability lists just as regularly as Windows.
It looks like a lot, but in practice three of those layers (workstations, servers, firewall) generate 90% of the risk. The rest can be added gradually.
Patch management without expensive tooling
Vendors will happily sell you a dedicated platform for €7,000–14,000 a year. In a 30-person firm that's overkill. Four things are enough, and together they cost less than a single entry-tier licence.
- An asset list. A Google sheet with columns: name, IP, type (workstation/server/network/IoT), OS, version, owner, last patched. Without this you don't know what you haven't patched.
- A distribution mechanism. For Windows — built-in Windows Update for Business (via GPO/Intune) or free WSUS. For Linux servers —
unattended-upgrades. For firmware — manually from the list. - A vulnerability scanner. Free Nessus Essentials (16 IPs), OpenVAS or an external service like Tenable Free for scanning public IPs. One scan a month, report to the administrator.
- A rhythm and an owner. One person — internal or external — with a concrete window in the calendar. "Thursday 7:00, an hour, coffee, restart servers" has to be in somebody's calendar, otherwise it dissolves.
This can all be stood up in a single day. After that it's a matter of holding the discipline.
A maintenance window that doesn't make the team hate you
The most common reason patch management falls apart isn't technical — it's organisational. An employee whose machine tells them "updating, do not turn off" three times a week will simply disable automatic updates or start ignoring restart prompts. The team needs a predictable rhythm.
What works in practice in an SME:
- Workstations — overnight window plus one scheduled restart per week. Updates download in the background, install at night. If a restart is required — enforced Friday 5 p.m., with two hours' warning.
- Servers — a single monthly window, announced a week in advance. E.g. the second Thursday of the month, 7:00–8:00 a.m. Everyone knows. Critical systems — test environment first, if you have one.
- Firewall and network gear — during zero-traffic hours. Usually a weekend morning. Rollback plan ready before flashing the firmware.
- Communication — short, one-sentence, by email. "Thursday 7 a.m., Optima server restart. System available from 8 a.m." No fluff. The credibility of that message is the key — if the window slips by two hours once without warning, the team will stop trusting the next one.
The communication discipline around restarts is the part of patch management nobody teaches on a technical course, and it's the part that decides whether the process survives month two.
What to do with old systems that can't be patched
In every manufacturing SME we've worked with, there has been at least one device that can't be updated. A CNC controller on Windows XP. An old accounting application whose vendor has vanished. A medical scanner with firmware from 2012. These systems aren't going away — and often can't be replaced tomorrow, or this quarter.
The strategy is one thing: isolate instead of patching. Specifically:
- Separate it into its own VLAN with no internet access and a minimal, explicitly documented connection to the rest of the network.
- Disable all unnecessary network services and open ports.
- Keep an up-to-date copy of its configuration in a safe place (for recovery).
- Have an explicit migration or replacement date on the calendar — even if it's "2027." Without a date, the topic comes back up during the attack.
It isn't ideal. It's sensible. Patch management in an SME isn't about everything being current all the time. It's about knowing what isn't, and having it consciously isolated.
A 30-day starter plan
If you're reading this with a faint unease because your firm "doesn't really have" patch management, the good news is that 30 days is enough to get to a sensible starting point.
- Week 1 — inventory. A list of everything with an IP address. What kind of system, who looks after it, when it was last patched.
- Week 2 — scan. A free vulnerability scanner on the external and internal IPs. A report. A priority list: what's critical, what's important, what's cosmetic.
- Week 3 — first window. Patching the 10 most serious findings. The first real maintenance window for servers. Communication to the team.
- Week 4 — process. The window booked into the calendar for the next 12 months. A one-page A4 description of the process. A named owner.
After 30 days you don't have a perfect state. You have something much more valuable — a list, a rhythm, and a person responsible. The rest is repetition.
If you'd like to walk through this with someone who does it regularly in 10–50 person companies — we help SMEs set up patch management in a way that doesn't require hiring a full-time admin. The first conversation is free and takes half an hour.
Most attacks on SMEs don't use brilliant techniques. They use patches that have been sitting on the shelf for eleven months.