AI agents · Process automation · Custom software · Košice, Slovakia
+421 903 921 243 info@easytrade.sk
Free consultation SK
Home · Blog · Why keep servers and software updated: risks and patch management

Why keep servers and software updated: risks and patch management

An unpatched server is not stable, just unchanged. What the data says about exploited flaws, what end of support means and how to update without downtime.

7 min read securityserversmaintenance
IT administrator checking updates on a small business server

Most small businesses have a server that “has run for years without a problem”. That is exactly why it deserves attention: software that never changes does not get safer, while attackers change every day. Below: the data, three well-known incidents with one shared pattern, and how to update without downtime.

“It works, so I don’t touch it” – the most expensive sentence in IT

An unpatched system is not stable. It is merely unchanged. Every month brings fixes for remotely exploitable bugs, and every fix is also a public description of a hole. Attackers see it just as you do – but they search for it automatically, with scanners that sweep the whole internet. They do not care whether you are a bank or a joinery with ten staff.

A small business is not an exception; it is the easiest target. It exposes the same public services as a large company – website, email, VPN – with fewer people and less oversight.

What the data says

Verizon DBIR 2025 analysed over 22,000 security incidents. Vulnerability exploitation was the initial vector in 20% of breaches, up 34% year on year. Attacks through edge devices – firewalls and VPN gateways – rose from 3% to 22%. Companies did patch these holes, but only 54% were fully remediated, with a median fix time of 32 days. Ransomware featured in 44% of breaches – and in 88% of those at small and medium-sized businesses. The 2026 edition reports that vulnerabilities now open 31% of breaches – more than stolen credentials.

IBM Cost of a Data Breach 2026 puts the global average cost of an incident at USD 4.99 million (up 12% on the previous year) and the time to identify and contain it at 247 days. For a small business, downtime matters more than the headline figure: if your production line or online store stands still for a week, the lost revenue and wages are your cost of the incident.

ENISA Threat Landscape 2025 (4,875 EU incidents, July 2024 – June 2025): phishing was the entry point in 60% of breaches, vulnerability exploitation in 21.3%. ENISA notes that new vulnerabilities are exploited within days of disclosure and that ransomware has the greatest impact.

The practical conclusion: ransomware is now first and foremost a small-business problem, not a corporate one.

Three well-known incidents, one shared pattern

WannaCry (2017)

Microsoft released patch MS17-010 on 14 March 2017. The attack came on 12 May 2017. In England it hit 81 of 236 NHS trusts and cancelled at least 6,912 appointments. The UK National Audit Office (NAO) found that infected organisations were running unpatched or unsupported Windows.

Equifax (2017)

A flaw in Apache Struts – a common web application library – was disclosed with a patch in early March 2017. Equifax set itself a 48-hour internal deadline, but the patch was never applied. From 13 May 2017 attackers had access to its systems for 76 days before anyone noticed. Around 147 million people were affected, and the company agreed to pay at least USD 575 million.

MOVEit Transfer (2023)

File transfer software used by businesses and public bodies. The CL0P group began exploiting CVE-2023-34362 on 27 May 2023. CISA added it to its catalogue of actively exploited vulnerabilities on 2 June and issued a joint advisory with the FBI on 7 June. By November 2023, according to Emsisoft’s tally, over 2,600 organisations and around 77 million people had been affected. Those who patched within days were spared.

The shared pattern:

  1. The patch existed weeks or months before the attack.
  2. The company did not apply it – out of caution, lack of time, or because nobody knew about it.
  3. The attack was automated. Nobody chose that company; a scanner found it.

What “end of support” means, and what you are probably running past it

End of support means the vendor no longer releases security fixes. A new vulnerability discovered a month later stays open for good. Status as of July 2026:

  • Windows 10 – end of support 14 October 2025.
  • Windows Server 2012 R2 – end of support 10 October 2023; paid Extended Security Updates (ESU) end 13 October 2026.
  • PHP 8.1 – security fixes ended 31 December 2025; PHP 8.2 ends 31 December 2026.
  • MySQL 5.7 – in Sustaining Support with no new fixes since 25 October 2023; MySQL 8.0 has been in the same mode since 21 April 2026.
  • Ubuntu 20.04 LTS – standard support ended in May 2025 (paid Ubuntu Pro runs to 2030); Ubuntu 22.04 LTS ends in May 2027.

A typical small-business picture: a website on PHP 8.1, an ERP on MySQL 5.7, the accountant on Windows 10 – none of it receiving fixes today. If you do not know which versions you run, ask your administrator today.

Why companies do not update – and what to do about it

What we hear What to do about it
“We’re afraid something will break.” A test environment and a backup before each update. Downtime can be planned; an attack cannot.
“Our ERP vendor doesn’t support the newer version.” A contractual obligation for the vendor to support current OS, database and PHP versions.
“Nobody has time for it.” A fixed calendar: one two-hour window a month, booked in advance.
“We don’t know what we have.” A system inventory – one spreadsheet, one person responsible.
“The new version costs money.” A planned annual renewal budget. Replacement is cheaper than an outage.

Patch management for a company without an IT department

You do not need a department – just a procedure an external administrator can run, with one person in the company checking it.

  1. Inventory. A list of systems and versions, who is responsible for each, and where the documentation lives.
  2. Classification. Critical = anything reachable from the internet: website, email, VPN, firewall, remote desktop. Internal = ERP, file server, workstations.
  3. A rule for critical fixes. Patch actively exploited vulnerabilities within 48–72 hours. The CISA KEV catalogue and your national CSIRT’s warnings (in Slovakia, SK-CERT) tell you what is being exploited. Routine fixes follow a monthly cycle (Patch Tuesday, the second Tuesday of the month).
  4. A test environment. For the website and ERP, at least a staging copy of production where every update is tried first.
  5. A backup before every update and a tested rollback procedure. A backup you have never restored from is not a backup.
  6. A maintenance window outside business hours, announced to the team in advance.
  7. A record. What, when, who, and with what result.
  8. An annual end-of-support review – every January, go through the inventory and plan replacements.

A month at, say, a manufacturing company with 60 employees, a website, an ERP and 30 workstations: Microsoft’s patches land on the second Tuesday and the workstations install them automatically overnight by Friday. The server is updated on Saturday morning in a one-hour window with a reboot. The web and ERP vendors deploy fixes to staging first, then to production on Monday morning. When the national CSIRT warns about the VPN gateway, the administrator patches it within 48 hours without waiting for the window.

How to update without downtime

For web applications, two environments avoid downtime (blue-green – the new version runs alongside the old and traffic switches only after verification), as do containers swapped without stopping the service. The server’s operating system needs a reboot – hence the out-of-hours window. On Linux servers, enable automatic security updates (for example unattended-upgrades) for system packages – except where an automatic reboot would stop a database or ERP.

If you run custom software, ask your vendor who updates its dependencies – frameworks and libraries age just like the operating system. Maintenance and updates belong in the contract, not in goodwill.

What the law may require of you

NIS2 (Directive (EU) 2022/2555) applies to medium-sized and large enterprises in the listed sectors. Article 21(2) sets out the mandatory measures; point (e) explicitly covers security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure. Member states had until 17 October 2024 to transpose it. Slovakia did so through Act No. 366/2024 Coll., amending Act No. 69/2018 Coll. on cybersecurity, effective 1 January 2025. Companies in scope register with the National Security Authority (NBÚ) within 60 days of starting the activity.

GDPR applies to anyone processing personal data – a five-person company included. Article 32 requires appropriate technical and organisational measures, and unpatched systems appear in fines as a specific failing: in March 2022 the UK regulator ICO fined a law firm GBP 98,000 for breaching Articles 5 and 32 – partly because it took five months to apply the fix for a critical Citrix vulnerability and had no multi-factor authentication.

A test question: if a regulator asked today when you last updated the server holding personal data, what would you show them?

Key takeaway: Unpatched software is not stable, merely unchanged – and attackers find it automatically. In WannaCry, Equifax and MOVEit alike, the patch existed before the attack. Small-business patch management means an inventory, a split into critical and internal systems, a fixed monthly calendar, a test environment and a backup before every change. Take the first step today: find out what you are running past its end of support.

If you are not sure what you are running past its end of support and how to renew it safely, start with a review of your systems – the first step is a free consultation with Easytrade.

Sources

Easytrade

A software and AI company from Košice, Slovakia – since 2011 we have helped companies integrate AI agents, automate processes and build custom software.

All articles
Blog

More articles

7 min read

Securing AI agents at work: permissions, logs, GDPR and the AI Act

A chatbot answers; an AI agent acts – it reads emails, searches your CRM, fills in orders and sends messages. If you are piloting one or about to go live, you need to know what it can break, how to fence it in, and what GDPR and the AI Act require you to have on paper. Below are four layers, each with its typical threat and its legal duty.

AI agentssecurityGDPR
7 min read

Custom software or off-the-shelf? A decision framework for SMBs

Companies with 10 to 200 employees sooner or later run into the limits of spreadsheets or a cheap subscription. Then comes a decision that will shape how people work for years: buy a ready-made system, or have one built. This article gives you a framework for comparing the two options honestly – including the costs that never make it into the quotes.

custom softwaredecision-makingtotal cost
7 min read

AI invoice processing automation: what works and what doesn’t

If several hundred invoices reach you every month by email, as PDFs and as scans, somebody is retyping them. AI can now take over most of that work – but not all of it, and not without rules. Success is not decided by a promise of “100% automation” but by a single metric: how many documents get through without a person touching them.

process automationinvoicesAI agents

Want to put one of these topics into practice?

The first consultation is free and without obligation. We will walk through your process and tell you what makes sense to automate first.

Book a free consultation