The NCSC's patch wave warning: what a small business should do about updates

In May 2026 the National Cyber Security Centre (NCSC) told organisations to get ready for a surge of software updates. Its chief technology officer, Ollie Whitehouse, called it a "vulnerability patch wave". If you run a small business, the practical message is simple. Updates are about to matter more, and the businesses that cope best will be the ones that have already decided how updates get applied.

This post explains what the NCSC said, what it means for a firm with a handful of laptops, a router, a website and a few cloud accounts, and what you can do this week without hiring anyone.

What the NCSC actually said

In its blog post, the NCSC argues that many software producers and operators carry a backlog of technical problems, built up over years of favouring short-term gains over resilient products. It says that when skilled people use AI, they can exploit that backlog at scale and at pace. The NCSC therefore expects a "forced correction" across open source, commercial, proprietary and software-as-a-service products, and it expects a number of the incoming updates to be critical.

Trade press picked this up quickly. Infosecurity Magazine described a patch wave as "a rush of software updates that will need to be applied across the technology stack". You do not need to understand the AI side to act on it. The point is that fixes may arrive in bigger batches than you are used to, and some will be urgent.

The guidance is written for organisations of all sizes, not just small ones, so some of it (supply chain assurance, specialist workstations) is aimed at larger firms. The parts below are the ones that translate well to a small business.

The NCSC's advice, in plain English

• Update by default. Apply updates as soon as possible, ideally automatically. The NCSC does accept that some safety-critical or operational systems may need exceptions.
• Turn on automatic updates where they exist. The NCSC says to enable them, including on embedded devices, which reduces the load on whoever looks after your IT.
• Look at what is exposed to the internet first. The NCSC says to identify and reduce internet-facing systems, starting with perimeter technology such as routers and firewalls, then working inwards to cloud and on-premises systems.
• Move fast when something is being exploited. If a critical flaw is being actively exploited, especially on an internet-facing system, speed up the update process.
• Deal with old kit. The NCSC warns that patching alone may not fix products that are out of support and can no longer receive updates. Its advice is to replace the technology or return it to support, particularly if it is exposed to the internet.

Where automatic updates are not available, the NCSC suggests using risk-based prioritisation, and it names a method called SSVC (Stakeholder Specific Vulnerability Categorisation) for deciding what to install first. For most small firms the simple version of that is: internet-facing things first, then the systems that hold your customer data, then everything else.

What this means for a small business

Most small businesses do not have an IT department. Updates are done by whoever notices the prompt, or by nobody. That works when updates are occasional and low drama. It works less well when the NCSC is telling the country to expect more of them, some critical.

The things that quietly go unpatched in small firms tend to be the same few:

• The broadband router or firewall at the premises, which nobody has logged into since it was installed.
• Your website platform, its plugins and themes, if you run something like a content management system.
• Older laptops and phones that have stopped receiving updates from the manufacturer.
• Till systems, printers and other devices that people forget are computers.
• Browser extensions and small apps installed years ago.

Routers and firewalls sit at the edge of your network, which is exactly the place the NCSC says to look at first. If you have one job to do this week, check the router.

Cyber Essentials already asks for this

If you have wondered whether Cyber Essentials is worth the effort, patching is one of its five technical controls. The NCSC lists them as firewalls, secure configuration, security update management, user access control and malware protection. On the NCSC's Cyber Essentials page, standard certification is tiered by organisation size and starts at £320 plus VAT. The page also says organisations with a turnover under £20m that certify their whole organisation automatically receive free cyber liability insurance arranged by IASME, including 24 hour incident response support. Check the current terms on the NCSC page before you rely on that.

On the detail of the update rule, one UK compliance consultancy's summary says high-risk or critical updates should be applied within 14 days of the vendor's release, that in-scope software must still be supported by its vendor, and that you should not simply assume updates happen automatically. I could only confirm that from a third-party summary rather than the scheme documents themselves, so if you are going for certification, read the current requirements from your assessor or the NCSC rather than relying on this paragraph. It is still a sensible working rule: do not leave serious fixes sitting for weeks.

A sensible routine for a small firm

You do not need specialist software to be in better shape than most. Here is a routine that fits in an hour a month, plus a one-off setup.

• Make a list. Write down every device and every piece of software that connects to the internet: laptops, phones, router, till, printers, website, plugins, cloud tools. A shared spreadsheet is fine.
• Switch on automatic updates. For Windows, macOS, iOS and Android, browsers and office software, this is normally a setting. Do it on every device, including staff phones that access work email.
• Pick a fixed day. For things that cannot update themselves, such as some routers and website plugins, choose one day a month to check and apply updates. Put it in the calendar.
• Check support status. For each item on your list, ask whether the maker still provides security fixes. If not, replace it, or at least keep it off the internet and away from customer data.
• Know who is responsible. If a web agency, IT provider or software supplier looks after something for you, ask them how and how quickly they apply security updates, and get the answer in writing.
• Back up before big updates. A tested backup means a bad update is an inconvenience, not a crisis.

Questions to ask your suppliers

A patch wave also affects the people who build and run your systems. If an agency hosts your website, or a company supplies your online ordering, ask a few plain questions:

• Who applies security updates to our site and the software underneath it?
• How quickly are critical fixes applied once they are released?
• What happens if an update breaks something, and how do we get back to a working version?
• Is any part of our system running software that is no longer supported?

A good supplier answers these without fuss. A vague answer is useful information too. If you would like help reviewing how your website, apps or cloud services are kept up to date, our cloud and security team can talk it through.

Do not panic, and do not ignore it

The NCSC is not saying that every update will be a crisis, or that small businesses must suddenly run a security operations centre. It is asking organisations to prepare: to make updating a habit rather than an event, to know what is exposed, and to retire things that can no longer be fixed. Some commentators have noted that many organisations lack continuous visibility of their systems, and for a small firm the answer to that is the list in the routine above. It costs nothing and takes an afternoon.

Start with the router, switch on automatic updates everywhere you can, and write down the fixed day. If a critical warning appears for something you use, you will already know where it lives and who is responsible for fixing it.