Patch Management for Small Business: Steps and Cost (2026)

Patch management means keeping every device and piece of software your company uses, from PCs and phones to network equipment and WordPress, up to date without gaps, in a set order, with records. Updates do more than fix bugs: they close vulnerabilities that are already publicly known. Attackers go after devices that stay unpatched after a fix is released, so missed updates lead to incidents quite directly. For companies with 10 to 50 people, the first step is not hard. List your devices and software, separate what can safely auto-update from what should be checked first, and set one fixed day a month for review. That alone removes most missed updates. As a general cost guide, doing it in-house costs close to nothing extra, management tools run from a few thousand to tens of thousands of yen a month, and outsourcing starts at tens of thousands of yen a month. This article explains why missed updates cause incidents, how to take inventory, update frequency by asset type, how to collect vulnerability information, how to handle end-of-life equipment, three operating models and their costs, a five-step rollout, common mistakes, a checklist and an FAQ, for companies without a dedicated IT person.

When a vulnerability is found, the vendor publishes a fix (a patch), and the existence and content of the weakness become widely known. The key point is that once a fix is out, the location of the weakness is public too. For an attacker, the patch is a clue: look for targets that have not updated yet and try them one by one. In other words, the later a company updates, the easier a target it becomes.

Internet-facing equipment is especially at risk. Examples include VPN devices for remote work, routers linking sites, externally visible UTMs (unified threat management appliances), and public-facing CMSs such as WordPress. Because they can be reached directly from outside, a known vulnerability left unpatched can let an attacker in even without cracking any password. Public agencies and security organizations have repeatedly issued warnings about damage from attacks that exploit known vulnerabilities in network devices and CMSs.

Another blind spot is equipment nobody thinks about. Multifunction printers, NAS (network file storage), internal switches, security cameras and recorders often run for years without a single update after installation, because nobody is in charge and everyone assumes someone else is updating them.

Updates are rarely neglected out of ill will. The causes usually come down to three things.

- Nobody knows what exists where (there is no list of devices and software)
- Fear of breaking operations (people do not want to touch something that works)
- No one owns the job (responsibility floats between administration, the field and outside vendors)

A routine can fix all three. Inventory solves the first, splitting updates into groups solves the second, and a fixed owner and schedule solve the third. For building the list itself, see how to start IT asset management.

Update management starts with a list. Anything not on the list gets forgotten and stays unpatched. Do not aim for perfection; first write down what exists, where, and who uses it, across the following eight categories.

- PCs and operating systems: Windows and macOS, including spare, shared and home-use machines
- Phones and tablets: both company-issued and personal devices used for work (BYOD)
- Browsers and related software: Chrome, Edge, PDF viewers, archive tools
- Microsoft 365, Google Workspace and similar: separate the cloud side, which updates itself, from the apps installed locally such as Office
- Network equipment: routers, UTMs, VPN devices, switches, Wi-Fi access points
- NAS, multifunction printers and peripherals: file storage, printers, security cameras, recorders
- Websites such as WordPress: core, themes and plugins, plus the server-side PHP and OS
- Business software and core systems: accounting, sales, attendance, in-house systems

Beyond the name, noting the following speeds up later decisions.

- Product name, model number and software version
- Location and day-to-day administrator
- The vendor or reseller that installed it (including whether a maintenance contract exists)
- The manufacturer's support end date (write "unknown" if you do not know)
- Whether it can be reached directly from the internet (those come first)

One spreadsheet is enough. Marking "support end date unknown" and "visible from the internet" at this stage feeds into the prioritization described below. See IT asset management for example columns.

Each asset type has its own update mechanism and recommended cadence. The table below is a general guide; adjust it to your operations and contracts. When a critical vulnerability is announced (one the vendor calls urgent), respond right away instead of waiting for the regular day.

The ranges differ because the impact of an outage and the likelihood of being targeted differ by asset. As a rule, internet-facing equipment gets a shorter cycle than equipment used only inside the office.

Doing every update by hand does not last. Making everything automatic can occasionally stop operations. So split them: automatic where an outage would be minor, tested first where it would be serious.

Testing does not need an elaborate environment. A realistic approach for small companies is to apply the update to one or two machines first, wait a few days, then roll it out. For Windows, simply designating the least critical machine, such as an administrator's PC, as the pilot machine helps. For network equipment, back up the configuration before updating and prepare a checklist of functions to try afterward.

Also confirm in advance whether you can roll back. Some firmware can return to the previous version and some cannot; handle the latter with extra care. Keep the vendor or maintenance contact handy before you start in case something fails.

To judge which updates matter, you need some exposure to vulnerability information. Reading everything every day is unrealistic, so small companies should receive information only about the products they use, through fixed channels.

There are three practical tips. First, register for notifications all at once, working from the product names on your list. Second, fix a weekday and time and spend just 15 minutes a week. Third, for items marked as actively exploited, urgent or critical, decide on the spot whether action is needed instead of waiting for the regular day. Whether you own the product can be answered immediately from the list, which is why the list makes the information useful.

A vulnerability assessment is one way to have an outside party check what weaknesses remain. See vulnerability assessment costs. Patch management is the daily upkeep; an assessment is a third-party check of the result, and the two play different roles.

Inventory often turns up equipment and software whose support has ended. Once support ends, no fixes are issued even when new vulnerabilities are found. In other words, there is nothing to update to. In patch management, spotting what cannot be updated and deciding to replace it matters more than the effort of updating what can be.

Think of priorities as follows.

- Top priority: EOL internet-facing equipment (old VPN devices, old routers, public servers with old OSs). Replace it or stop it from being reachable from outside
- Next: internal equipment that is important for operations (servers for core systems, NAS). Plan replacement and cut external connections until then
- Plan ahead: EOL equipment with small impact. Replace it at the next refresh

If you cannot replace something right away, temporary measures include disconnecting it from the internet, placing it on an isolated network, and limiting who uses it and for what. These only buy time and are not a fundamental fix. For how to check support dates and plan replacement, see the end-of-support guide.

When replacing network equipment, the cost of a UTM may be a concern. UTM and firewall costs organizes the thinking by deployment type.

Who runs update management, and with what tools, falls into three models. Costs vary by size, number of devices and contract terms, so the figures below are general market ranges, shown as rough guides. Always confirm actual amounts with a quote.

In-house costs little, but work concentrates on one person. If that person leaves or goes on leave, operations stop, so keep procedures and the list in a shared place. The main advantage of management tools is a single view of update status; for phone management in particular, see the MDM guide for mobile devices. With outsourcing, clarify before signing what you hand over and what stays with you. Whether you ask for "performing the updates" or only "notifications and reports" changes the price a great deal.

In practice, combining models is realistic: manage PCs and phones with a tool, hand network equipment and WordPress to a vendor, and keep the master list and decisions in-house. Keeping the decisions (what to update and when) in-house while outsourcing the work tends to keep responsibility clear.

When comparing costs, look beyond the monthly fee at hidden costs too.

- Effort for initial setup and rolling the tool out to devices
- Time and cost to recover when an update fails
- Surcharges when updates are done on holidays or at night
- Minimum seat or device counts (some products are out of reach for small teams)

Do not aim for the finished state at once. Proceed in this order and aim to complete one full cycle in about a month.

Step 1: Decide the owner and contact point (1 day). Name one person in charge and one deputy. Send vendor notification emails to a shared address rather than a personal one so that departures and transfers do not break the chain. It also helps when the owner of the company states clearly that this is part of the job.

Step 2: Take inventory and build the list (1 to 2 weeks). Write down devices and software across the eight categories above. Leaving items as "unknown" is fine. Fill in "visible from the internet?" and "support end date" first.

Step 3: Set priorities (half a day). Put items that are internet-facing and EOL or of unknown end date at the top. Next come items with large operational impact, then the rest. Some items needing immediate replacement may surface here.

Step 4: Set up automatic updates and a regular day (1 week). Confirm and enable automatic updates for what can be left automatic (OS, browsers, phones). Set a monthly routine day for what needs testing first (network equipment, NAS, WordPress, etc.). Create the pilot machine and the update procedure at this stage too.

Step 5: Keep records and review monthly (ongoing). After each update, add one row to the list: date, target, version, result. Once a month, check what has not been updated and what is nearing the end of support, and give the owner of the company a five-minute report. The report speeds up budgeting and replacement decisions.

A particularly common failure is stopping at the feeling of having updated. Downloading without restarting, or leaving an "update available" notice in the admin screen untouched, are easy mistakes in the field. Writing the post-update version in the list doubles as a check.

The number of items you can answer yes to shows where you stand. You do not need to fill them all; the gaps are your next tasks.

- An owner and a deputy for update management are named
- A list of devices and software exists and is updated at least once a year
- Internet-reachable devices are identified
- Each device's support end date is recorded (unknown ones marked as under investigation)
- Automatic updates are enabled on PCs, phones and browsers
- Check days are set for firmware on routers, UTMs, VPN devices and NAS
- WordPress core and plugins are checked at least weekly
- Settings and data are backed up before updates
- A procedure exists to try a pilot machine before rolling out
- Vendor notification emails go to a shared address
- JVN, IPA and similar information is checked on a fixed weekday
- Update records (date, target, version, result) are kept
- EOL equipment has a replacement plan or a substitute measure
- Update status is reported to management monthly