--- title: "SpySecure® | Patch management for SMEs: who installs updates?" description: "Who installs security updates on your laptops, servers and firewall? A simple patch management guide for SMEs: who does what and what to fix first." image: https://www.spysecure.nl/hubfs/B5_featured_image_EN.png --- ✓ Trusted by **100+** businesses★★★★★ **5.0** on Google[View our plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png?width=200&height=40&name=logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png)](https://www.spysecure.nl/en/?hsLang=en) - Cybersecurity for businesses - All-in-one cybersecurity - Who it's for - Our approach - Pricing [NL](https://www.spysecure.nl/kennis/patchmanagement-mkb-beveiligingsupdates)[EN](https://www.spysecure.nl/en/knowledge/patch-management-sme-security-updates) [Contact](https://www.spysecure.nl/en/contact?hsLang=en) - [Why cybersecurity?Risks and consequences for SMEs](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) - [What security do you need?The security layers explained](https://www.spysecure.nl/en/security-layers-smes?hsLang=en) - [BlogInsights and current threats](https://www.spysecure.nl/en/knowledge) - [WebinarsJoin live or watch on demand](https://www.spysecure.nl/events?hsLang=en) - [FAQQuick answers to your questions](https://www.spysecure.nl/en/faq?hsLang=en) NIS2 Does NIS2 apply to your business? Read what the law requires and how to show your security is in order. [Go to NIS2 →](https://www.spysecure.nl/en/nis2?hsLang=en) [Managed SecurityAll security layers, fully managed and monitored 24/7→](https://www.spysecure.nl/en/managed-security?hsLang=en) [Security layers](https://www.spysecure.nl/en/approach?hsLang=en) - [Endpoints / devices](https://www.spysecure.nl/en/endpoint-security?hsLang=en) - [M365 & Google Workspace](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) - [Cloud & SaaS](https://www.spysecure.nl/en/cloud-security?hsLang=en) - [Email](https://www.spysecure.nl/emailbeveiliging?hsLang=en) - [Identities](https://www.spysecure.nl/identiteitenbeveiliging?hsLang=en) - [Backups](https://www.spysecure.nl/backups?hsLang=en) Training - [Employee training](https://www.spysecure.nl/en/training?hsLang=en) - [Phishing test](https://www.spysecure.nl/en/phishing-test?hsLang=en) Compliance - [Compliance management](https://www.spysecure.nl/en/compliance?hsLang=en) - [NIS2 compliance](https://www.spysecure.nl/en/nis2?hsLang=en) Scans & extras - [Vulnerability scan](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) - [Penetration test](https://www.spysecure.nl/pen-test?hsLang=en) - [Business password manager](https://www.spysecure.nl/en/business-password-manager?hsLang=en) - [Domain protection](https://www.spysecure.nl/en/domainprotection?hsLang=en) Plans From €9.99 per licence per month. Fully managed, including all the security software you need. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) Businesses - [Startups & scale-ups](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [SMEs](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Sectors - [E-commerce](https://www.spysecure.nl/en/cybersecurity-ecommerce?hsLang=en) - [Education](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Healthcare](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Professional services](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Partners - [MSPs](https://www.spysecure.nl/en/partners?hsLang=en) - [IT partners](https://www.spysecure.nl/en/partners?hsLang=en) Customer stories ★★★★★ Trusted by 100+ businesses Read how business owners placed their security with us. [Read the customer stories →](https://www.spysecure.nl/en/our-customers?hsLang=en) - [Our approachHow we secure your business](https://www.spysecure.nl/en/approach?hsLang=en) - [How it worksFrom introduction to 24/7 monitoring](https://www.spysecure.nl/en/how-it-works?hsLang=en) - [Customer storiesExperiences of our customers](https://www.spysecure.nl/en/our-customers?hsLang=en) - [About usThe team behind SpySecure®](https://www.spysecure.nl/en/about-us?hsLang=en) Google reviews ★★★★★ 5.0 on Google Our customers rate us 5 stars. [What our customers say →](https://www.spysecure.nl/en/our-customers?hsLang=en) - [All-in-one plansFully managed · from €9.99 per licence](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual servicesPer service · from €4.99 per licence](https://www.spysecure.nl/en/security-services?hsLang=en) [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png?width=200&height=40&name=logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png)](https://www.spysecure.nl/en/?hsLang=en) Cybersecurity for businesses - [Why cybersecurity?Risks and consequences for SMEs](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) - [What security do you need?The security layers explained](https://www.spysecure.nl/en/security-layers-smes?hsLang=en) - [BlogInsights and current threats](https://www.spysecure.nl/en/knowledge) - [WebinarsJoin live or watch on demand](https://www.spysecure.nl/events?hsLang=en) - [FAQQuick answers to your questions](https://www.spysecure.nl/en/faq?hsLang=en) All-in-one cybersecurity [Managed SecurityAll security layers, fully managed and monitored 24/7→](https://www.spysecure.nl/en/managed-security?hsLang=en) [Security layers](https://www.spysecure.nl/en/approach?hsLang=en) - [Endpoints / devices](https://www.spysecure.nl/en/endpoint-security?hsLang=en) - [M365 & Google Workspace](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) - [Cloud & SaaS](https://www.spysecure.nl/en/cloud-security?hsLang=en) - [Email](https://www.spysecure.nl/emailbeveiliging?hsLang=en) - [Identities](https://www.spysecure.nl/identiteitenbeveiliging?hsLang=en) - [Backups](https://www.spysecure.nl/backups?hsLang=en) Training - [Employee training](https://www.spysecure.nl/en/training?hsLang=en) - [Phishing test](https://www.spysecure.nl/en/phishing-test?hsLang=en) Compliance - [Compliance management](https://www.spysecure.nl/en/compliance?hsLang=en) - [NIS2 compliance](https://www.spysecure.nl/en/nis2?hsLang=en) Scans & extras - [Vulnerability scan](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) - [Penetration test](https://www.spysecure.nl/pen-test?hsLang=en) - [Business password manager](https://www.spysecure.nl/en/business-password-manager?hsLang=en) - [Domain protection](https://www.spysecure.nl/en/domainprotection?hsLang=en) Who it's for Businesses - [Startups & scale-ups](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [SMEs](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Sectors - [E-commerce](https://www.spysecure.nl/en/cybersecurity-ecommerce?hsLang=en) - [Education](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Healthcare](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Professional services](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Partners - [MSPs](https://www.spysecure.nl/en/partners?hsLang=en) - [IT partners](https://www.spysecure.nl/en/partners?hsLang=en) Our approach - [Our approachHow we secure your business](https://www.spysecure.nl/en/approach?hsLang=en) - [How it worksFrom introduction to 24/7 monitoring](https://www.spysecure.nl/en/how-it-works?hsLang=en) - [Customer storiesExperiences of our customers](https://www.spysecure.nl/en/our-customers?hsLang=en) - [About usThe team behind SpySecure®](https://www.spysecure.nl/en/about-us?hsLang=en) Pricing - [All-in-one plansFully managed · from €9.99 per licence](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual servicesPer service · from €4.99 per licence](https://www.spysecure.nl/en/security-services?hsLang=en) [Contact](https://www.spysecure.nl/en/contact?hsLang=en) [NL](https://www.spysecure.nl/kennis/patchmanagement-mkb-beveiligingsupdates)[EN](https://www.spysecure.nl/en/knowledge/patch-management-sme-security-updates) Endpoint security Patch management Vulnerability management # Security updates: who actually installs them in your company? Who installs security updates on your laptops, servers and firewall? A simple patch management guide for SMEs: who does what and what to fix first. 4 September 2026 ![SpySecure](https://www.spysecure.nl/hubfs/icon%201%20-%20no%20white%20-%20resized.png) SpySecure [![Patch management overview: four of six company devices have the security update, a laptop and the firewall do not yet.](https://www.spysecure.nl/hubfs/B5_featured_image_EN.png)](https://www.spysecure.nl/hubfs/B5_featured_image_EN.png?hsLang=en) Click to enlargeTap to enlarge Every week, software suppliers release security updates. Some of them fix serious flaws that attackers are already using. Those updates need to be installed quickly. But who in your company actually does that? And how do you know the update was installed on every computer and device? In many small and medium-sized businesses, nobody knows for sure. This article explains who should install which security updates, which ones are urgent, and how to check that they really worked. **Jump to:** [Who installs updates](https://www.spysecure.nl/en/knowledge/patch-management-sme-security-updates#who-installs) [What to fix first](https://www.spysecure.nl/en/knowledge/patch-management-sme-security-updates#what-first) [How to check](https://www.spysecure.nl/en/knowledge/patch-management-sme-security-updates#check) [5-step checklist](https://www.spysecure.nl/en/knowledge/patch-management-sme-security-updates#checklist) ## Who installs security updates in your company? Every device in your company needs updates. But they are not all updated by the same person, and some are not updated by anyone.   ### Laptops **Who usually does it:** Often the employee, when the laptop asks for it. **What often goes wrong:** Updates get postponed, the laptop is not restarted, and other programs such as browsers and PDF readers are forgotten.   ### Servers and storage **Who usually does it:** Your IT supplier, if it is in the contract. **What often goes wrong:** Often it is not in the contract, or updates wait for a maintenance moment that never comes.   ### Firewall, VPN and router **Who usually does it:** Often nobody, once they are installed. **What often goes wrong:** These devices can be reached from the internet, so attackers look for them first.   ### Printers, cameras and other devices **Who usually does it:** Usually nobody. **What often goes wrong:** They keep running old software for years.   ### In short The devices that attackers try first, like the firewall and VPN, are often the ones nobody feels responsible for. ## Which security updates should you install first? New updates come out every week. Not all of them are urgent. Three simple questions tell you what to do first: 1. **Can the device be reached from the internet?** 2. **Are attackers already using this flaw?** The security advisories of your national cyber security centre tell you. In the Netherlands that is the NCSC, in the US it is CISA. 3. **How bad is it if this device is hacked?** Today Devices that can be reached from the internet, with a flaw that attackers already use. For example, your firewall or VPN. This week Other devices with a flaw that attackers already use, and internet-facing devices with a critical flaw. Every month Everything else, in a fixed monthly update round. Is there no update yet? Then limit who can reach the device, follow the supplier's advice, or switch the device off until there is a fix. ## How do you know an update really worked? Installing an update is not the same as being protected. A laptop that has not restarted, or a device that was switched off, can still be vulnerable. A vulnerability scan checks your devices and network for missing updates and weak settings. But a scan only shows the problems. Someone still has to fix them, and then check again. 1**Installed** On every device that needs it. 2**Restarted** So the update is active. 3**Scanned again** The problem is gone. 4**Reported** You see what is fixed and what is still open. ## Patch management checklist: 5 steps for SMEs Patch management simply means: keeping all your software and devices up to date, in a fixed way. You do not need a large IT team for it. You need clear agreements. 1 ### Make a list of your devices Write down all laptops, servers, firewalls, routers and other devices, and the software on them. You cannot update what you do not know you have. 2 ### Decide who updates what Write down one name for each type of device. Check whether your IT contract includes security updates, and how fast they are installed. 3 ### Make sure someone reads the warnings Someone should follow the advisories of the national cyber security centre (in the Netherlands: the NCSC) and the messages from your suppliers, and check whether they affect your devices. 4 ### Scan every month Scan your network and the devices that can be reached from the internet. Scan again after a serious warning. 5 ### Ask for a monthly overview What was found, what was fixed and what is still open? "We took care of it" is not enough. A new scan shows whether it is really fixed. ## In short - Every device needs updates, but not every device has someone who installs them. - Install updates first on devices that can be reached from the internet and that attackers already target. - An update only counts when it is installed, the device has restarted and a new scan confirms it. SpySecure can take this off your hands. We scan your devices and network every month with our [vulnerability scan](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en), install the updates and watch your environment day and night with one of our [cybersecurity plans](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en). Contact ## Want to know which updates are still missing in your company? Leave your details and we will get in touch to look at your situation together.   Sources - [NCSC: security advisories](https://advisories.ncsc.nl/) - [CISA: list of vulnerabilities that attackers are known to use](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) [Endpoint security](https://www.spysecure.nl/en/knowledge/tag/endpoint-security) [Patch management](https://www.spysecure.nl/en/knowledge/tag/patch-management) [Vulnerability management](https://www.spysecure.nl/en/knowledge/tag/vulnerability-management) In this article [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%20white%20(bold)%20-%20transparent%20-%20sized.png?width=200&height=34&name=logo%20white%20(bold)%20-%20transparent%20-%20sized.png)](https://www.spysecure.nl/en/?hsLang=en) Fully managed cybersecurity, training and compliance for scale-ups and SMEs. - 24/7 monitoring, detection and response - Monthly reporting ### Solutions - [Managed Security](https://www.spysecure.nl/en/managed-security?hsLang=en) - [Compliance](https://www.spysecure.nl/compliance?hsLang=en) - [Security Awareness Training](https://www.spysecure.nl/training?hsLang=en) - [NIS2](https://www.spysecure.nl/nis2?hsLang=en) - [Domain protection](https://www.spysecure.nl/domeinbescherming?hsLang=en) - [For IT partners](https://www.spysecure.nl/partners?hsLang=en) ### Pricing - [All-in-one plans](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual services](https://www.spysecure.nl/en/security-services?hsLang=en) ### Resources - [Events and webinars](https://www.spysecure.nl/events?hsLang=en) - [Blog](https://www.spysecure.nl/kennisbank?hsLang=en) - [FAQ](https://www.spysecure.nl/en/faq?hsLang=en) - [Customer stories](https://www.spysecure.nl/en/our-customers?hsLang=en) ### Contact - [Book an introduction](https://www.spysecure.nl/en/contact?hsLang=en) - [contact@spysecure.nl](mailto:contact@spysecure.nl) - [+31 20 261 2897](tel:+31202612897) ### Newsletter Once a month: the key threats and tips for your business. Ask AI about SpySecure®[ChatGPT](https://chatgpt.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Claude](https://claude.ai/new?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Gemini](https://gemini.google.com/app?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Perplexity](https://www.perplexity.ai/search?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Copilot](https://copilot.microsoft.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Grok](https://grok.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.) © SpySecure® 2026. All rights reserved. [Privacy](https://www.spysecure.nl/privacy-policy?hsLang=en)[Cookies](https://www.spysecure.nl/cookie-policy?hsLang=en)[Terms](https://www.spysecure.nl/en/terms?hsLang=en)