Across the vulnerability scans I've run — 100+ endpoints at one client, 60+ at another — the single most common finding, by a wide margin, is outdated software: unpatched Windows systems, old firmware on network devices, and applications running versions with publicly known vulnerabilities. Not exotic zero-days — publicly known issues with a fix already available.
Why this keeps happening
- Patching is invisible when it works, and disruptive when it doesn't — so it gets postponed
- "If it isn't broken, don't touch it" — a reasonable instinct for most things, a risky one for security patches
- No one is explicitly responsible for it, so it silently falls through
What a reasonable routine looks like
- Windows/Linux servers and workstations — monthly patch cycle, tested on a small group first if the office is large enough to matter, then rolled out
- Network devices (firewall, switches, access points) — firmware updates checked quarterly, applied when a security-related update is released, not just for new features
- Applications — anything internet-facing or handling sensitive data gets priority; general software follows the OS patch cycle
What this actually prevented
During a Nmap and Nessus assessment for a wealth advisory client, patch-related findings made up the largest share of issues flagged — outdated software versions with known, published exploits. Closing those gaps through a straightforward update cycle removed most of the risk, without needing any new tooling or budget.
Where to start if there's no routine today
Run one vulnerability scan to get a real baseline — not a guess — of what's actually out of date. Fix the highest-severity findings first, then set a recurring monthly reminder. That alone puts most small offices well ahead of where they were.