This week, ask whoever manages your computers for a short list of your most exposed systems, the servers and anything reachable from the internet, and how quickly each gets patched. Put those first. Microsoft’s Security Blog published an analysis on November 2 that points to the same order.
Build the list, then rank it
Start with an inventory that one person owns. In a small office that is usually the owner, the office manager or your IT provider. It should name every server, firewall, router, and any system that staff or vendors reach from outside the building.
Then put each item in one of two groups. The first group holds anything that, if taken over, would give someone access to files, email or accounts: servers, remote access systems and anything holding administrator passwords. The second holds everything else.
Ask for a date next to each item in the first group. A blank date is your answer.
What Microsoft found, and why it changes the order
Microsoft’s analysis counted roughly 383,000 disclosed software vulnerabilities through September 2026. Only about 2,000 of them, around half a percent, have been tied to real-world attacks, according to the post.
The ones attackers used leaned heavily toward takeover flaws, such as running code remotely, gaining higher privileges or getting around a login. Microsoft says those account for 78% of the exploited group.
The post also describes a timing gap. Servers took longer to patch than workstations in Microsoft’s data, and attackers moved within days of a flaw becoming public. Your busiest, most important machines tend to be the ones waiting longest.
How Data Cube Systems handles patching and blocking
At Data Cube Systems, Windows updates go out overnight through remote management tools, usually after being tested on a few machines first. Staff generally see nothing but a restart prompt the next morning.
Servers are different. We patch and reboot them in a maintenance window agreed with the client, when nobody is working, and we take a backup or snapshot before any major change. If an update breaks something, a technician removes it and holds it back, or applies the fix Microsoft documents. When Microsoft ships an emergency fix outside its monthly cycle, we schedule it as emergency maintenance rather than waiting.
Patching is not the only layer. ThreatLocker allowlisting lets only approved software run, so a program an attacker drops on a machine is blocked, and the user sees a pop-up where they can send a request. A technician checks the file before approving anything. SentinelOne watches for malicious behavior and can roll a computer back after ransomware.
Where offices get this wrong
A patch schedule is not protection against a flaw that is being exploited today. If a fix is two weeks out, or the system is too old to patch at all, the exposure continues for that whole time.
The other common mistake is treating every alert as equal. Offices burn hours on low-risk items while a server with a known takeover flaw waits for the next quiet weekend. Microsoft also cautions that a flaw’s stated impact does not always match what an attacker can actually do, so a rating on paper is a starting point, not the final word.
Old equipment is the hardest case. A printer, a firewall or a line-of-business server that no longer gets updates should be replaced or walled off, and the cost of that is better planned than discovered after an incident.
Two questions for your IT provider
Your provider should be able to name which of your systems can be reached from the internet, and which of those is the oldest. A good answer comes back with names and dates, not reassurance.
The second question is what one of those systems could get to if someone took it over. Servers often run with more access than they need, and that access is what turns one bad day into a long one. Limiting it is usually a small change made during a scheduled window.