Consequences of outdated software: what actually happens

Postponing an update produces no immediate effect. That is exactly what makes it a hard habit to correct: the cost never arrives at the moment you take the decision.

When it does arrive, though, it has a characteristic that sets it apart from the other scenarios in this series: it often concerns more than one person. Uncorrected defects are exploited indiscriminately, against whoever turns out to be reachable — and moving from one device to the others on the same network is easy.

This post describes the effects across the five planes on which a consequence is measured. It expands on the recommendation keeping your software up to date.

A realistic scenario

Helen runs a practice with three computers, a small server for the archives, and a router nobody has touched since it was installed.

System updates are set to “ask before installing”. For months the answer has been “later”: there are always deadlines, and restarting during working hours is inconvenient.

One Monday morning the practice’s files no longer open. The defect exploited had been known for fourteen months, and the fix had been available for thirteen.

There had been no targeted attack: just an open defect on a reachable machine.

1. Operational consequences: the work stops

A practical example

The three computers can no longer reach the archives. The work in progress is on the server, and the server is the machine affected.

Possible effects

• a complete stop to the work, not the loss of a single function;
• documents and archives unreachable for days;
• the need to rebuild the systems from scratch, not just repair them;
• spread to other devices on the same network;
• a gradual restart, with weeks of backlog to clear.

Why it matters

There is a difference from the other scenarios in this series: here you do not lose access to an account, you lose the use of your tools. No recovery procedure with a provider can help, because the problem is on your own devices.

The only thing that shortens the timeline is a copy of the data that is not permanently connected — which is a decision to take beforehand, not afterwards.

2. Financial consequences: when downtime has a cost

A practical example

The practice is at a standstill for six days. In the meantime: technical work, two machines replaced, and clients’ deadlines slipping.

Possible effects

• revenue lost for the days of inactivity;
• restoration costs: technical support, possibly replacement hardware;
• penalties or lost contracts for missed deadlines;
• the cost of the backlog, which gets cleared with extra hours;
• possible demands for payment to restore the data — which offer no guarantee and feed the phenomenon.

Why it matters

On that last point it is worth being clear: paying is not a solution, it does not guarantee recovery and it does not stop it happening again through the same open defect. The route is restoring from a copy and closing the vulnerability.

The comparison stays what it always was: the update cost a restart.

3. Legal and regulatory consequences: other people’s data on unpatched systems

A practical example

The practice’s systems hold client documents, records, correspondence.

Possible effects

• an obligation to assess and, where the conditions apply, notify the breach to the competent authority and to the people concerned;
• the need to reconstruct what was exposed, often without firm evidence;
• responsibility towards clients for the data entrusted to you;
• in a professional setting, possible contractual consequences;
• difficulty showing that adequate measures were in place, if the defect was known and the fix had long been available.

Why it matters

The last point is specific to this scenario: the public availability of a fix is documented and dated. Not updating for months is a verifiable circumstance. This section describes the general picture and does not replace a legal assessment: in the event of a breach involving third parties’ personal data, it is advisable to consult a professional or your data protection contact.

4. Reputational consequences: clients’ trust

A practical example

Helen has to tell her clients that their documents were on compromised systems, and that she cannot say with certainty what was read.

Possible effects

• clients asking for an explanation of how their data was being kept;
• a perception of carelessness, hard to correct;
• the loss of current or future work;
• the need to communicate uncertainty, which is harder to explain than a fact.

Why it matters

The reputational damage here has a particular trait: the cause is understandable to anyone. “They had not updated” is an explanation that needs no technical knowledge to be judged, and that is why it weighs.

5. Personal consequences: the burden on the person living through it

A practical example

Helen spends a week coordinating the restoration and the communications. Then weeks rebuilding what was not in the copy.

Possible effects

• prolonged stress and a sense of responsibility towards colleagues and clients;
• personal time entirely absorbed;
• the loss of material that cannot be replaced, if the copies were partial;
• guilt over a decision taken dozens of times without thinking;
• in some cases, a distrust of automation — which leads to worse choices.

Why it matters

It should be said clearly, as in the other units: postponing an update is not negligence. It is a reasonable response to an interruption that always arrives at the wrong moment. The problem is not the single decision, it is that it repeats — and that is exactly what automation removes.

The cost in time

The comparison with the alternative makes the disproportion obvious: an update takes a restart.

Why these consequences fall on several people

It is the trait that sets this unit apart from the earlier ones.

In the recommendations on passwords, the starting point is an account of yours. Here the starting point is a device on a network, and networks are shared:

• at home: computers, phones, tablets, cameras and televisions see the same network;
• in a practice or a business: colleagues’ machines and the shared archives;
• outwards: the client data held on those systems;
• further outwards still: a compromised device can be used to reach others, even outside your network.

A practical consideration follows: the least updated device on the network determines the level of protection of all the others. And it is nearly always the one nobody looks at — the router, the camera, the old tablet.

Why the bill arrives all at once

There is a characteristic of timing that sets this scenario apart from those about passwords, and it explains why it is so easy to underestimate.

Postponing an update does not produce a gradual worsening. There is no moment when you notice things going badly: nothing happens for months, and then everything happens in one morning.

The typical sequence is this:

1. The fix is released. No visible effect: the device works as before.
2. Weeks pass. Still no effect. The decision to postpone looks confirmed by the facts.
3. The defect gets searched for at scale. Still no signal, unless you are among the systems reached.
4. One Monday morning, the work stops.

The trouble with this dynamic is that the first three stages teach the wrong lesson: every day without consequences reinforces the idea that postponing is fine. That is why automation works better than awareness: it removes a judgement that daily experience tends to distort.

How to reduce the risk

1. Turn on automatic updates on every operating system. It is the measure that removes the repeated decision.
2. Schedule installation outside working hours, so the interruption is never a problem.
3. Do a round of the forgotten devices: routers, network printers, cameras, smart TVs, old tablets.
4. Check each device’s support status: if it no longer receives updates, it should be isolated or replaced.
5. Keep a copy of your data that is not permanently connected. It is the only thing that turns a total stop into a two-day inconvenience.
6. Check that the copy works: a copy never tested is an assumption, not a protection.
7. Uninstall what you do not use. Every program fewer is one surface fewer to maintain.

Quick checklist

• ☐ Automatic updates are on for every device I use
• ☐ The router has been updated in the last twelve months
• ☐ I know which of my devices no longer receive updates
• ☐ A copy of the important data exists, not permanently connected
• ☐ I have checked at least once that the copy really restores
• ☐ I know who to turn to if other people’s data were exposed

How this connects to the Cyber Welfare Framework

Reference level: FL2 — Beginner, with elements of FL3 — Autonomous in the parts on copies and network devices.

Conclusion

Outdated software does not produce gradual consequences: nothing happens for months, and then everything happens at once. And unlike other scenarios, the damage rarely stops at the person who postponed.

The disproportion between cause and effect is why this recommendation deserves more attention than it gets: one restart against weeks of restoration.

Something to think about. If your computer’s files would not open tomorrow, which copy would you restart from — and when did you last test it?

Related content

• Keeping your software up to date — the recommendation this belongs to
• Impact of unpatched vulnerabilities — the technical plane: what stays exposed
• How to manage updates — what to do, in order of priority
• Attacks on known vulnerabilities — how a scenario like this comes about

Related resources

Short reads from the Resources section, for anyone who wants to stop on a single aspect:

• System updates
• Data backup

Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.