One missed update can leave an avoidable route into your business. Computers, servers, phones and websites all need ongoing attention.
Your computer starts every morning. Your website loads. Your server keeps the business running.
Everything appears fine—but that does not tell you whether those systems contain security weaknesses that criminals already know how to exploit. Security updates repair these weaknesses. Delaying them can leave an avoidable route into your business.
One overlooked component can create a serious problem
A recent WordPress investigation uncovered malicious files on a website. Finding malware does not, by itself, establish whether the attacker entered through outdated software, stolen credentials or another weakness.
Every website nevertheless needs ongoing maintenance covering WordPress, plugins, themes and the underlying hosting software. Responsibility for each layer must be clear.
Real incidents show what is at stake
WannaCry stopped essential work
Ransomware disrupted NHS services and led to cancelled appointments. Investigators found unpatched or unsupported Windows systems among those infected.[1]
The lesson: missing updates can interrupt operations across an organisation.
Exchange became an entry point
Attackers exploited unpatched, self-hosted Exchange servers, installed backdoors and conducted further attacks, including ransomware.[2]
The lesson: updating Windows alone does not update every server application.
Deceptive files exploited Windows
Criminals combined misleading shortcut files with a Windows weakness to trick people into running malicious software. Microsoft released patches in July 2024.[3]
The lesson: a modern operating system still needs security updates.
An attack without a click
BLASTPASS allowed targeted attackers to compromise iPhones without the victim clicking anything. Apple released security fixes.[4]
The lesson: careful browsing alone cannot protect against every attack.
A web component exposed data
Equifax’s attackers entered through a vulnerable component behind its online dispute portal. The FTC subsequently alleged that a critical patch had not been applied.[5]
The lesson: software behind a website needs maintenance too.
Old flaws exposed remote access
Fortinet reported stolen VPN credentials from devices left unpatched against a vulnerability fixed in May 2019.[6]
The lesson: security equipment itself needs security updates.
Some attacks, including the Windows shortcut and iPhone examples, began before fixes existed. Those initial victims could not install an unavailable patch. Applying the fix once available closes a known opportunity for further attacks.
Could a Windows 10 PC expose the business?
Yes, particularly if it no longer receives applicable security updates. Regular support for standard Windows 10 Home and Pro installations ended on 14 October 2025. Eligible business devices can receive critical and important fixes through Microsoft’s commercial Extended Security Updates programme for up to three years.[7]
This is a temporary migration bridge requiring appropriate enrolment and continued installation of updates. Specialist editions have their own support dates.
For example, a compromised employee PC may expose documents, accounts and shared resources available to that employee—even when email is hosted in Microsoft 365. This is a possible attack scenario; a Windows 10 label alone does not prove compromise.
Cloud services and phones still need attention
Microsoft maintains the Microsoft 365 cloud platform. Your business remains responsible for protecting the devices accessing it. Browsers, desktop applications and connected systems also need maintenance. A server hosted in the cloud may still require you or your IT provider to manage its updates.[9]
Include both iPhone and Android system and app updates in your maintenance plan, and plan to replace phones that no longer receive security fixes.
Make updating a managed process
- Know what you have. Include computers, servers, websites, phones, firewalls and storage devices.
- Track support dates. Agree on upgrades or replacements before security coverage ends.
- Prioritise urgent risks. Act promptly on exploited weaknesses and internet-facing systems.
- Plan the work. Test major changes, maintain recovery options and schedule necessary downtime.
- Verify completion. Investigate failed updates, missed devices and outstanding restarts.
- Make it easy for staff. Explain when to leave devices on, restart and report update failures.
The goal is a supported, compatible system with current security fixes. If a compromise has already occurred, patching is only part of recovery: malicious access and stolen credentials may need separate investigation and remediation.[2][6]
Patch. Restart. Verify.
Primeworks helps South African businesses identify update gaps, plan upgrades and establish practical endpoint security and IT maintenance routines.
Sources and further reading
- UK National Audit Office — WannaCry and the NHS
- Microsoft — Attacks exploiting Exchange Server vulnerabilities
- Check Point Research — Windows shortcut attacks and July 2024 patches
- Citizen Lab — BLASTPASS; Apple — iOS 16.6.1 security fixes
- Equifax — Incident details; FTC — Equifax settlement and patching allegations
- Fortinet — Disclosure of stolen SSL-VPN credentials
- Microsoft — Windows 10 Extended Security Updates
- Microsoft — Windows 11 version 24H2 support deadline
- Microsoft — Shared responsibility in the cloud