How Often Should UK Businesses Patch Their Software?
A clear, direct answer to this question — written for UK business owners and IT decision-makers.
Direct Answer
Cyber Essentials requires all operating systems and applications to be patched within 14 days of a security update being released. Critical vulnerabilities should be patched within 24 hours where possible. AMVIA automates patch management for all managed endpoints, ensuring compliance with Cyber Essentials and reducing your attack surface continuously.
Key Points
What you need to know.
The Short Answer
A concise overview of what you need to know.
For UK Businesses
How this applies specifically in the UK context.
Cost Considerations
What to expect in terms of investment and ongoing costs.
Next Steps
What you should do with this information.
Quick Comparison
| Feature | Option A | Option B |
|---|
Frequently Asked Questions
The 14-day window reflects the typical timeframe between a vulnerability being publicly disclosed and attackers weaponising it at scale. Once a patch is released, the vulnerability details become public knowledge, giving criminals a roadmap to exploit unpatched systems. Cyber Essentials certified organisations are 92% less likely to claim on cyber insurance (IASME), and meeting the 14-day patching requirement is a core reason for that reduced risk.
If a patch cannot be applied — for example, due to compatibility with line-of-business software — the system should be isolated from the network or placed behind additional compensating controls. Unsupported software that no longer receives patches must be removed from scope entirely. 43% of UK businesses experienced a breach or attack (DSIT 2025), and unpatched systems remain one of the most exploited entry points for attackers.
Automation is strongly recommended for operating system and standard application patches. Manual oversight should be retained for critical line-of-business applications where patches need testing before deployment. A managed IT provider can handle both — automating routine updates whilst scheduling tested rollouts for sensitive systems. Only 40% of UK businesses have two-factor authentication enabled (DSIT 2025), and automated enforcement of security controls, including patching, closes these gaps consistently.
Related Questions
Cyber Essentials Certification
AMVIA's managed Cyber Essentials service — gap assessment, remediation, and certification at a fixed price.
Managed IT Support
AMVIA automates patch management for all managed endpoints as part of the fully managed IT service.
Endpoint Security Service
EDR-based endpoint protection that works alongside patch management to reduce your attack surface.
Protect your business → Get Cybersecurity Assessment