The majority of successful cyber attacks exploit known vulnerabilities — software flaws that the vendor has already released a patch for. Attackers don't need zero-days when organisations take months to apply available patches. This is the patch management problem, and it affects nearly every NZ small business.
In 2017, the WannaCry ransomware attack encrypted computers in over 150 countries, caused an estimated $4 billion in damages, and paralysed parts of the UK's National Health Service. The vulnerability it exploited — EternalBlue, in Windows SMB — had been patched by Microsoft two months earlier. Every computer that WannaCry hit was running an operating system that hadn't been updated since before the patch was released.
This pattern repeats constantly. The MOVEit attack in 2023, which affected hundreds of organisations worldwide including NZ entities, exploited a SQL injection vulnerability that had a patch available. The Hafnium Exchange Server attacks exploited vulnerabilities that were patched within days of being disclosed. In the Verizon Data Breach Investigations Report, exploitation of known vulnerabilities consistently ranks in the top three attack vectors — vulnerabilities with available patches, not theoretical zero-days.
Why NZ Small Businesses Have a Patch Problem
Patching is unglamorous, disruptive, and invisible when it goes right. Windows updates restart computers. Application updates break things occasionally. Server patches require a maintenance window. In a small business without a dedicated IT team, patches accumulate behind the priority of running the business.
A 2023 survey of NZ SMBs found that 43% had operating systems or applications that were more than 90 days behind on patches. Some businesses were running end-of-life software that no longer receives security patches at all — Windows 7, Office 2010, Windows Server 2012 — because "it still works" and replacement hasn't been prioritised.
End-of-life software is particularly dangerous because vulnerabilities continue to be discovered and disclosed — but no patches are released. Attackers know this and specifically scan for end-of-life systems.
What Comprehensive Patch Management Looks Like
Effective patch management covers three categories: operating system patches (Windows Update, macOS updates), application patches (browsers, Office, Adobe, Java, and other installed software), and firmware (BIOS, network device firmware, printer firmware). Most organisations focus on the first category and neglect the latter two — which is where attackers increasingly focus.
Browsers and browser-based applications are among the highest-frequency patch targets — Chrome and Edge release security updates every few weeks. An unpatched browser is one of the easiest ways to get malware onto an endpoint, particularly in combination with malvertising (malicious ads served through legitimate ad networks).
How Optimyze Manages Patching
Optimyze uses Microsoft Intune and patch management tooling to deploy operating system and application patches to all managed endpoints on a defined schedule: critical security patches within 48–72 hours of release, high severity patches within two weeks, and routine patches monthly. Firmware updates are reviewed and deployed quarterly or immediately if a critical vulnerability is disclosed. Patch compliance reports are included in monthly managed IT reporting — every client can see which endpoints are patched and which have outstanding updates.
Attackers look for the easiest way in. Unpatched systems are a well-lit, unlocked door. Staying current on patches closes it — and most of the time, it closes it before any attacker gets near it.
