It starts with a small bubble in the corner
You know the one. A restart-to-update prompt shows up in the corner of the screen at 9:40 on a Tuesday morning, which is the worst possible time, so the person at the keyboard clicks Later. They click it again after lunch. They click it again the next day. By Friday nobody sees it anymore. It has become part of the furniture.
That one click, repeated on every computer in the building, is why so much of the software a business runs on is months behind on its fixes. And staying behind is now the most common way a business gets broken into.
What the numbers actually say
Verizon puts out a yearly report on how breaches really happen, called the Data Breach Investigations Report. The 2026 edition came out in May and covers what happened during 2025. Its headline finding is a first in the report's nineteen-year history: getting in through a software flaw has passed stolen passwords as the number one way attackers get inside. Exploited software flaws were the entry point in 31 percent of breaches. Stolen credentials dropped to 13 percent.
Here is the part that should bother a small business owner. Most of those flaws already had a fix. Only 26 percent of the critical flaws on the government's Known Exploited Vulnerabilities list were fully patched during 2025, down from 38 percent the year before. That list is worth knowing about: it is a short, public list of the flaws attackers are already using in the real world. The middle of the pack took 43 days to get a critical fix fully installed, up from 32 days the year before. The fixes exist. They just are not going in.
Why it never happens
Because every update feels like a small interruption, and interruptions are the one thing a five person office cannot afford.
A restart means the person doing payroll stops mid-task. It means the front desk loses the screen they were working on. It means the software the shop has leaned on for a decade might act strange afterward. So the update waits for a quiet moment, and there is no quiet moment. Acronis, whose software watches patching across a large base of machines, reported in its second-half 2025 telemetry that the middle of the pack takes about a week to install Microsoft updates. The slowest ten percent stretch past five weeks. The machines that wait are exactly where the trouble lands.
What good looks like
It does not look like never restarting, and it does not look like someone rebooting machines at random when they get a free minute. It looks like maintenance that happens on purpose.
Someone decides in advance when updates install, and picks the time that costs the business the least. That person checks that the awkward machines came back up: the till, the computer driving the label printer, the one running the old scheduling program. They keep a short list of the flaws that matter most, the ones attackers are already using, and make sure those go first. And they can answer one plain question: which computers are behind right now?
Most small businesses cannot answer that last question. You cannot keep up with something you are not watching.
Three things this week
Find out where you stand. Write down every computer the business uses. Note which ones install updates on their own and which ones have been asking to restart for weeks.
Pick a time and let them restart. Late in the day, over lunch, whenever the fewest people are in the middle of something. Then walk around and make sure everything came back up.
Name one person who owns it. If it is nobody's job, it is nobody's job.
And if a machine truly cannot be updated, because its operating system is too old or one stubborn program pins it in place, that is not a reason to shrug. It is a decision. It deserves to be made on purpose instead of by default.
The bubble in the corner is easy to ignore. That is exactly what makes it expensive.