What an update actually is
Software is written by people, and large programs inevitably contain mistakes. Some mistakes are minor annoyances. Others are security weaknesses that someone could exploit to read data, take control of a device or install harmful software. When developers find or are told about a problem, they release an update that corrects it.
Updates apply to nearly everything you use: the operating system on a phone or computer, web browsers, apps, plug-ins, and the firmware inside devices such as routers, printers and smart home equipment. Each is a program that may need fixing over time.
What updates do
Fix security vulnerabilities. This is the most important reason. When a flaw becomes publicly known, details about it may spread, and attackers may try to take advantage of any device that has not yet been fixed. An update closes the gap. Keeping up gives attackers fewer known openings, though it does not make a device invulnerable.
Repair bugs. Updates correct crashes, odd behavior and data errors that make software unreliable.
Improve performance and compatibility. Changes can make software faster, more efficient with battery, or compatible with newer devices and file formats.
Add or change features. Some updates bring new options or a different look. Feature changes can take getting used to, which is one reason people avoid updating, but they are separate from the security benefit.
Keep support going. Software eventually reaches an end-of-support date, after which it no longer receives security fixes. Running unsupported software generally gets riskier with time, and replacing it may become necessary.
Why delay carries risk
Putting updates off is understandable. They interrupt work, take time, and occasionally cause problems of their own. But the longer a known flaw remains unfixed, the more time anyone interested has to exploit it, and automated tools can scan for outdated software at scale. Many successful attacks use weaknesses for which a fix already existed.
That said, the risk of any one delayed update is not always high, and different updates carry different urgency. Security updates are generally the ones worth applying promptly.
Habits that make it easier
- Turn on automatic updates where they are offered, for the operating system, browser and apps. This is often the simplest and most reliable option.
- Choose a convenient time. Many devices let you schedule installs overnight or outside working hours.
- Restart when asked. Some updates only take effect after a restart, so a device left running for weeks may be protected less than it appears.
- Check periodically. If you prefer manual updates, set a regular reminder. Folding this into a weekly review habit keeps it from slipping.
- Do not forget the quiet devices. Routers, cameras, printers, tablets you rarely use and old phones can lack current fixes. Check the maker’s guidance for how to update them, and consider replacing devices that no longer receive updates.
- Remove what you do not use. Old apps and browser extensions are extra things that need updating. Uninstalling them shrinks the number of things to maintain.
- Keep enough free storage and battery. Updates need space and power. Plug in a laptop or phone before a large update.
Doing it safely
Attackers know that people expect update prompts, so fake ones exist.
- Install updates through your device’s official update feature or the app’s own settings, or from the official source, rather than through a pop-up in a web page or a link in a message.
- Be suspicious of a website that suddenly claims your browser, player or system is out of date and offers a download. That is a common tactic described in phishing emails and scam pages.
- Do not download updates from sources you cannot verify.
Before a major system update, it is sensible to make sure your important files are backed up, since occasionally an update goes wrong. Good file backups mean a failed update is an inconvenience rather than a loss.
When an update causes trouble
Occasionally an update introduces a problem: a feature changes, an older program stops working, or a device slows down. If this happens, check the developer’s support information for known issues and fixes. In a work setting, an IT team may test updates before rolling them out, so follow your organization’s process. Some people wait a few days after a major release for early problems to surface, which is a reasonable approach for non-urgent feature updates but less so for urgent security fixes.
For website owners
If you run a website, its software, themes and plug-ins need the same care. Out-of-date components are a common way sites are compromised, and the habits are covered in website maintenance and website backups.
A small habit with a large payoff
Updating will not stop every threat, and it cannot protect you from handing a password to a fraudster. But it removes a class of risk at a low cost in time, especially when automated. Combined with strong, unique passwords and a degree of caution with messages, it is one of the more effective everyday protections.