Why updates matter
The update notice almost always arrives at the busiest possible moment, and “later” is an easy thing to say. Yet that small notice is usually waiting to close a known security hole on your device.
Short answer
Updates carry three things: patches that close security holes, bug fixes, and new features. The security patches are the critical part, because once a hole is announced attackers go looking for devices that have not been updated. Leaving automatic updates switched on is the least demanding protection there is.
What an update actually brings
An update package usually contains three kinds of change. The first and most important is security patches: the closing of flaws discovered in the software that could be abused. The second is bug fixes, covering crashes, battery drain and compatibility problems. The third is new features and interface improvements.
New features can wait; security patches accumulate risk the longer they are held off. Knowing that difference makes the question “should I update?” easier to answer.
The release notes published with an update are usually skipped, but they are instructive for anyone curious: they summarise which bugs were fixed and which security flaws were closed. That is where the answer to “what does this update bring?” lives, and even a few lines explain why it is waiting.
Why flaws create urgency
When a security flaw is patched, the patch effectively announces that the flaw existed. Attackers take that information and scan, with automated tools, for devices that have not yet installed the update. In other words, once the patch is out, an un-updated device becomes an even more visible target than it was before.
This holds not only for computers and phones but for every internet-connected device: modems, smart televisions, cameras. Firmware updates for these are the easiest of all to overlook.
The large-scale malware outbreaks of the past had one thing in common: they exploited flaws for which patches had been published months earlier, and the great majority of affected computers had simply not installed the available update. The picture is rarely one of being defeated by an unknown threat; it is one of leaving a known and closable door open. An update is what closes that door.
Automatic updates: switch on and forget
The most sustainable way of keeping up with updates is not to keep up with them at all: leave automatic updating switched on in the operating system, in the app store and in the browser. Modern systems generally download overnight while the device is idle, so your day is not interrupted.
For devices that need updating by hand — modems and smart home devices above all — a monthly check is enough. For what an operating system is and the part it plays in updates, see the operating system guide.
If you are wary of automatic updates interrupting your day, most systems let you set the installation time: define your active hours and restarts happen at night. In browsers the update is usually already downloaded and simply waiting for you to close and reopen the program; a browser left open for days is the most common hiding place for a pending update.
A little preparation before a big update
Updates rarely cause trouble, but a small amount of preparation before a major version change is reassuring. Make sure important files have a current backup and that the device has enough charge and free storage. If you have not set up any backup routine, the syncing and backup guide is a good starting point.
If you are in the middle of something critical, postponing an update by a few hours is of course sensible; the problem is when postponement stretches into weeks and months. If you say “this evening”, let it really be this evening.
Fake update traps
Users are not the only ones who know updates matter; so do fraudsters. Pop-ups appearing as you browse — “Your device is out of date, download now!” — fake browser warnings and update links arriving by email are not trustworthy; they are among the known ways malware is distributed.
The rule is simple: updates are applied only from the device's own settings, from the official app store, or from within the software itself. An “update file” downloaded from a web page is suspect by default. The phishing guide helps in recognising traps of this kind.
The same care applies to where apps come from: installation files downloaded outside the official store also sit outside the update mechanism and get stuck on old versions. An app installed from the store is both checked at installation and updated automatically; one choice buys two protections.
Checklist
- Turn on automatic updates in the operating system
- Enable automatic updates in the app store
- Check modem and smart device firmware once a month
- Take a backup before a major version change
- Give no credit to update files downloaded from web pages
Frequently asked questions
Will an update slow my device down?
Most updates maintain or improve performance. On very old devices a major new version can be demanding; there, continuing to take security patches while researching the big version change first is a balanced approach.
Should I install an update at once or wait a little?
Security patches should not be held back. Some people prefer to wait a few days on major feature releases to see how early users get on; that is a reasonable preference, as long as the wait does not stretch into weeks.
What should I do with a device that is no longer supported?
A device that receives no updates becomes risky over time. Moving sensitive activities such as banking to an up-to-date device, and using the older one for less critical tasks or keeping it off the network, is a sensible route.
Are app updates also about security?
Yes; browsers, messaging apps and banking apps receive security fixes regularly. Leaving automatic updates switched on in the store takes that burden off you.
This guide draws on the update advice of national cyber security bodies and on the official support documentation of software manufacturers.