Additional resource for the lesson “System Updates: Why They Are a Security Measure” — Online Security course
The notification asking you to restart is not housekeeping. Most system updates exist because somebody found a flaw, published it, and the manufacturer closed it — which means postponing the update leaves a door open that is now publicly known.
A. Why this matters
Updating systems and apps is not a technical inconvenience. It is one of the few security measures that requires no judgement, no expertise and, once configured, no attention at all.
The reason it matters is in how vulnerabilities become public. A flaw is found, reported, and fixed. Then the fix is published — and the fix itself tells anyone interested exactly what was wrong and how to exploit it on devices that have not applied it yet.
The key idea: the risk is not in the flaw existing. It is in the window between the fix being published and you installing it.
B. Key concepts
Six ideas about what an update actually does.
Security patches
Corrections that close specific, identified flaws in software.
Why it matters to you: They are the majority of what an update contains, even when the release notes talk about features. Skipping the update means skipping the corrections.
Known vulnerabilities
Flaws that have been publicly documented, usually with the fix that resolves them.
Why it matters to you: This is the uncomfortable part: an unpatched device is not vulnerable to something mysterious. It is vulnerable to something written down.
The window of exposure
The time between a fix being released and being installed on your device.
Why it matters to you: It is the only variable you control here, and automatic updates reduce it to almost nothing without any effort from you.
Automatic updates
The setting that installs updates without asking, usually overnight.
Why it matters to you: It removes the decision entirely, which is the point. The most common reason devices go unpatched is not refusal — it is postponement that becomes permanent.
Stability and compatibility
Updates also fix crashes, improve battery behaviour and keep applications working with each other.
Why it matters to you: Worth knowing because it counters the usual objection: updates are far more often the thing that fixes a problem than the thing that causes one.
Applications, not just the system
The operating system is one part. Browsers, office software, PDF readers and plugins all need the same attention.
Why it matters to you: Browsers and document readers are where most everyday exposure happens, because they open content from outside.
C. A practical example: three weeks of ‘remind me later’
A browser publishes an update that fixes a flaw allowing a malicious page to run code on the visitor’s computer. The fix is documented, as it should be.
- Within days, that documentation has been read by people with no interest in fixing anything.
- Pages designed to exploit it appear — usually through advertising networks rather than obscure corners of the web.
- Anyone who applied the update is unaffected. Anyone who postponed it three weeks ago is not.
Nobody targeted anyone. The exploit is indiscriminate: it works on whoever arrives without the fix.
This is why ‘I have nothing worth stealing’ does not apply. The attack does not know who you are, only what version you are running.
D. Try it yourself: turn it on and forget it
Ten minutes, once. The aim is to never make this decision again.
Step 1 — The operating system
- Phone, tablet, computer: find the update setting and switch on automatic installation.
- If you prefer to control the restart, at least enable automatic download so the fix is ready.
Step 2 — The applications
- Browser: check that it updates itself and restart it if an update is pending.
- App stores: enable automatic app updates.
- Office software and PDF readers: same setting, usually under preferences.
Step 3 — Check what is already pending
- Most devices have something waiting. Install it now rather than adding it to the list.
Step 4 — Set one recurring moment
- Once a month, restart everything. Many updates only complete on restart, and a device that never restarts is a device that never finishes updating.
Step 4 is the one people miss: a laptop that has been asleep rather than restarted for two months is often carrying updates it downloaded and never applied.
E. Videos, articles and further resources
Independent and institutional sources in English.
CISA — Update software
Why updates are a security measure and how to make them automatic, from the US cyber security agency.
https://www.cisa.gov/secure-our-world/update-software
NCSC (UK) — Install the latest software and app updates
The UK authority on the same point, including the advice about devices no longer supported by their manufacturer.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/install-the-latest-software-and-app-updates
NCSC (UK) — Cyber security advice for you and your family
The UK national authority’s advice hub for individuals: short, practical guidance written for people who are not IT professionals.
https://www.ncsc.gov.uk/section/advice-guidance/you-your-family
FTC — Malware: how to protect against, detect and remove it
What tends to arrive through the gaps that updates close.
https://consumer.ftc.gov/articles/malware-how-protect-against-detect-and-remove-it
CISA — Secure Our World
The US cyber security agency’s public programme: four basic actions, explained for people who are not IT professionals.
https://www.cisa.gov/secure-our-world
NCSC (UK) — Top tips for staying secure online
Six short pieces of advice from the UK’s national cyber security authority. A good starting point if you want the essentials without the jargon.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online
Links checked in August 2026.
F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior
This lesson sits on the Secure Behavior pillar at level FL1. It is the cheapest protection available, and the most frequently postponed.
Skills
- Enabling automatic updates on an operating system, a browser and an app store.
- Recognising which applications need attention beyond the system itself.
- Restarting devices so pending updates actually complete.
For professionals and organizations
- Managing updates centrally, with a defined window rather than individual decisions.
Awareness
- Understanding that published fixes also publish the flaw.
- Recognising that the risk is the delay, not the existence of the vulnerability.
- Knowing that exploits are indiscriminate: they select by version, not by person.
For future instructors and ambassadors
- Explaining why the fix reveals the problem. It changes ‘I should update’ into ‘I should update now’.
Secure Behavior
- Keeping automatic updates on across devices.
- Restarting periodically so updates finish.
- Applying updates to browsers and document readers with the same priority as the system.
For organizations
- Treating patch delay as a measurable risk rather than an administrative task (R6).
G. Questions to sit with
- When did you last restart your computer? Not close the lid — restart it.
- Are automatic updates on across all your devices, or only the newest one?
- Is there an update notification you have been postponing? What is it waiting for?
- Does your browser update itself, or does it wait for you to restart it?
H. What to do now
The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply to updates.
Updates
- R6 — Keep the software on your devices up to date, and enable automatic updates wherever possible.
Minimum commitment: This single recommendation covers the whole lesson. The work is in enabling it once, not in maintaining it.
What updates protect
- R17 — Do not open attachments from unknown sources: many attacks rely on a flaw the update has already fixed.
- R9 — Connect over HTTPS only.
- MS5 — Use a browser that updates itself and treats privacy as a default.
In short
- Most of an update is security fixes, whatever the release notes emphasise.
- Publishing the fix also publishes the flaw — which is why delay is the risk.
- Automatic updates remove the decision, which is the point.
- A device that never restarts never finishes updating.
Related resources in this course
Where updates fit alongside the rest:
- The Importance of Device Updates and Security
- Download Security: Deciding Before You Install
- Device Lock: The Barrier Everything Else Sits Behind
Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.
If you would like to follow the whole path, the Cyber Welfare Program is free and open to everyone.
Leave a Reply