Every smlal office I walk into has at least one laptop that hasn't rebooted in 94 days. The user is proud of it. I am not. That machine is a loaded gun pointed at your file share, and the trigger is a Chrome tab.
Patching is three separate jobs that owners usually blur into one. Operating system updates (Windows, macOS). Browser updates (Chrome, Edge, Firefox). Third-party app updates (Zoom, Adobe Reader, the twelve things sales installed). Each one has a different update mechanism and a different failure mode, and ignoring any of the three is how ransomware gets in.
At 15 people you don't need an enterprise patch management suite. You need a written rule and someone whose job it is to check the rule got followed. That's it. The rule I give clients: OS and browsers update automatically within 7 days of release, reboots happen Friday afternoon, and once a month someone opens every laptop and confirms the version numbers. Twenty minutes of work. Prevents the bad week.
Here's what I'd stand up this week if you have nothing. On Windows, turn on Windows Update for Business through Intune or Group Policy and set a 7-day deferral with a forced reboot deadline. On Mac, enable automatic macOS updates and automatic app updates from the App Store. For browsers, Chrome and Edge update themselves if you don't block them. For third-party apps, install Patch My PC (Windows) or just standardize on fewer apps so there's less to track.
The one bullet list this post gets, because it's the actual checklist:
I've watched owners try the manual version for a year. It fails the same way every time. Week one everyone patches. Week three the sales lead is on the road and skips it. Week six two people are on skipped-it streaks. Week twelve nobody remembers whose turn it was. By month six you have a 94-day-uptime laptop and a false sense of safety because "we do patches here."
Automate the boring part. Reserve the human for the audit. If your IT person (or your "IT person," the office manager who's good with computers) is spending their Tuesday clicking Next on update dialogs, you're paying someone to do what a scheduler does for free.
If your office has that one machine nobody's rebooted since summer and you'd rather not find out the hard way what's on it, send us a note. Patch hygiene for a 15-person office is a one-afternoon setup, not a project.
— Alexander @ SBATC
