Guide · Patching

Automatic Updates for Small Business: What to Turn On

By Christopher Smith, penetration tester·Published October 14, 2026·Updated October 15, 2026·4 min read

Most break-ins at small businesses don’t need a clever new attack. They use known flaws in software that simply hasn’t been updated. When a vendor publishes a security fix, attackers can study it too, and devices that wait weeks to update stay exposed the whole time. CISA keeps a public catalog of vulnerabilities known to be exploited in real attacks, and it is a long list.

The fix is boring and nearly free: turn on automatic updates everywhere you can, and set a deadline for the rest. Here is what to turn on for each device type, with links to the vendor’s own instructions.

Quick verdict

• Turn on automatic updates for OS and browsers first — that is where most day-to-day risk reduction lives for a small office.
• Schedule router / firewall firmware checks even when there is no perfect auto-update; stale edge gear is a common hole.
• Have a backup before you force big OS upgrades so a bad update does not become a business outage.
• Do not chase every plugin and appliance on day one. Finish Windows/macOS/browsers, then work through phones, network gear, and websites with a monthly 15-minute check.

Before you start: have a backup

Updates rarely break things, but “rarely” is not “never.” Make sure each computer’s important files are backed up somewhere other than the computer itself before you switch everything to automatic. Our backup guide covers the options. One low-cost option for laptops is IDriveAffiliate.

Windows 10 and 11

• Go to Settings → Windows Update. Updates download and install automatically by default. Don’t leave them paused.
• Turn on Get the latest updates as soon as they’re available if you want non-security feature updates sooner, and set Active hours so restarts happen outside the workday.
• Under Advanced options, turn on Receive updates for other Microsoft products so Office gets patched too.
• If you have Microsoft 365 Business Premium or Intune, manage update rings centrally so you can see who is behind. Microsoft’s Windows Autopatch service can automate this for eligible licenses (Microsoft: Windows Autopatch overview).

Vendor steps: Microsoft: get the latest Windows update.

macOS

• Go to System Settings → General → Software Update and click the ⓘ next to Automatic Updates.
• Turn on Download new updates when available, Install macOS updates, Install application updates from the App Store, and Install Security Responses and system files.

Vendor steps: Apple: update macOS on Mac.

iPhone and iPad

• Go to Settings → General → Software Update → Automatic Updates and turn on both downloading and installing iOS updates, plus Security Responses and system files.
• Turn on automatic app updates in Settings → App Store.

Vendor steps: Apple: update your iPhone or iPad.

Android phones

• Go to Settings → System → Software update (wording varies by manufacturer) and install anything pending. Also check Security & privacy → System & updates for security and Google Play system updates.
• In the Google Play Store, turn on automatic app updates.
• Check how long the manufacturer promises security updates for each model. A phone that no longer gets updates should not hold work email or banking.

Vendor steps: Google: check and update your Android version.

Browsers

Chrome, Edge, Firefox, and Safari update themselves, but usually only finish when the browser restarts. Tell staff to restart the browser when it shows an update prompt instead of leaving 40 tabs open for a month.

Routers, firewalls and Wi-Fi gear

Network devices are easy to forget and exposed to the internet all day.

• Log in to the router’s admin page or app and look for an automatic firmware update setting. Turn it on if it exists.
• If it doesn’t, put a reminder on the calendar to check for firmware monthly on the manufacturer’s support page.
• Change the default admin password and turn off remote administration from the internet unless you really need it.
• When the manufacturer stops releasing firmware for a model (often labeled “end of life”), replace it. An unpatched router is one of the easiest ways in.

WordPress websites

WordPress installs minor and security core releases automatically by default. Plugins and themes are where most risk lives, and their auto-updates are switched on per plugin.

• In Dashboard → Plugins, click Enable auto-updates for each plugin you trust, and do the same under Appearance → Themes.
• In Dashboard → Updates, you can opt in to automatic major core updates as well.
• Delete plugins and themes you don’t use. A deactivated plugin can still be a risk if it’s installed.
• Make sure your host takes daily backups you can restore from.

Vendor docs: WordPress: configuring automatic background updates.

Everything else

• Business apps (Zoom, Adobe, accounting desktops, PDF readers): turn on each app’s auto-update setting.
• Printers, cameras and smart devices: check for a firmware update option. If the vendor no longer supports the device, isolate it on guest Wi-Fi or replace it.
• Security software: make sure endpoint protection updates itself and alerts you. See our endpoint protection guide.

A simple monthly check (15 minutes)

1. Spot-check two or three computers: is Windows Update or Software Update showing “up to date”?
2. Check the router admin page for firmware.
3. Log in to WordPress and look for pending plugin updates.
4. Retire or replace anything that no longer receives updates.

Bottom line

Turn on automatic updates for Windows, macOS, phones, browsers, routers, and WordPress plugins. Give stragglers a 48-hour deadline, then force the restart. Keep a backup so a bad update is an inconvenience, not a disaster. It is the cheapest security control you have.