The Hidden Cost of Unpatched Software in New Zealand SMEs

In 2017, the WannaCry ransomware attack infected over 200,000 computers across 150 countries in a single day. Every single one of those computers was running a version of Windows with a known vulnerability — a vulnerability that Microsoft had patched two months earlier. The businesses affected weren't targeted because of who they were. They were targeted because their software wasn't up to date.

That pattern has not changed. CERT NZ consistently identifies unpatched software as the leading technical factor in successful cyberattacks against NZ businesses. And yet most SMEs still approach patching the same way — waiting for Windows to prompt a restart, hoping it's enough, and leaving hundreds of third-party applications untouched.

What "Patching" Actually Means

When most business owners think about software updates, they think about Windows Update and the occasional prompt to restart. That covers one layer of the problem. A fully-patched device actually requires:

• Operating system patches. Windows 10/11, Windows Server — Microsoft releases patches on the second Tuesday of every month (Patch Tuesday), with emergency patches for critical vulnerabilities released out-of-cycle.
• Microsoft 365 application updates. Word, Excel, Outlook, Teams — these update independently of the operating system and require their own management.
• Web browser updates. Chrome, Firefox, and Edge are among the most targeted applications because they handle untrusted internet content. Browser vulnerabilities are actively exploited within hours of public disclosure.
• Third-party application patching. Adobe Acrobat, Java, Zoom, Slack, and hundreds of other business applications each have their own update cycles. Windows Update does not manage these.
• Network firmware. Routers, switches, firewalls, and access points all run firmware that requires regular updates. These are frequently overlooked and often run for years without updates.

The Ransomware Economics of Unpatched Software

Ransomware groups are not sophisticated hackers exploiting novel vulnerabilities in real time. They are businesses. They buy exploit kits that target known, documented vulnerabilities — vulnerabilities with publicly available patches. Their business model depends on the gap between when a patch is released and when organisations apply it.

The average time to exploit a newly-patched vulnerability is now under two weeks. The average time for an NZ SME to apply patches across all their systems is measured in months — if it happens at all. That gap is where ransomware lives.

The Insurance and Compliance Dimension

Cyber insurance underwriters have become significantly more sophisticated about patch management in the past three years. Policies increasingly require:

• Documented patch management processes. Not just "we run Windows Update" — a formal process with defined schedules, exception handling, and compliance reporting.
• Evidence of current patch status. Insurers are asking for patch compliance reports at renewal and after claims. Businesses that cannot demonstrate current patching can face policy voidance.
• Third-party application coverage. Some policies now explicitly require patching of named third-party applications, not just the OS.

The NZ Privacy Commissioner treats failure to maintain current security controls — including patching — as a factor in determining whether a notifiable privacy breach involved reasonable precautions. If you experience a breach through an unpatched vulnerability, "we didn't know it needed updating" is not a sufficient answer.

What Managed Patch Management Looks Like

Effective patch management is a process, not a product. It involves:

• Patch testing before deployment. Applying patches directly to production systems without testing risks compatibility issues. Patches are tested in a controlled environment first.
• Defined deployment windows. Patches deploy during agreed maintenance windows to minimise business disruption. Emergency critical patches can be expedited with notification.
• Exception management. Some systems cannot be patched immediately — line-of-business applications with compatibility constraints, vendor-managed systems, or production equipment. Exceptions are documented with compensating controls and review dates.
• Compliance reporting. Monthly reports showing patch status across every managed device — which are current, which have failed updates, and any exceptions.

Patching is not exciting. It generates no revenue and solves a problem nobody sees until it's too late. But it is the single highest-return security control available to NZ businesses — and it is completely preventable to be caught by a vulnerability with a known patch.