“Update and restart now.”

So you click “Remind me tonight.” Tonight comes. You click “Remind me in 4 hours.” You keep clicking it until it forces the restart at the worst possible time, and now you’re annoyed at Microsoft.

I get it. I really do. But here’s the thing — that prompt is trying to save your business.

What Updates Actually Do

There’s a misconception that Windows Updates are just Microsoft adding features you don’t want and changing things that work fine. Sometimes that’s true — the occasional feature update does change the look and feel, and it’s annoying.

But the critical updates? The ones that interrupt your work? Those are usually security patches (delivered as part of monthly cumulative updates).

Here’s what that means in practice:

Microsoft’s security team (and independent researchers) find vulnerabilities in Windows. These are flaws that a criminal could use to get into your computer. Some vulnerabilities require no interaction at all — in some cases, just being on the same network with an unpatched machine is enough. Others rely on phishing or user action.

Microsoft releases a patch to fix the vulnerability. That patch gets delivered via Windows Update.

If you install the patch, you’re protected. If you don’t, the door stays open. And criminals know exactly which doors are still open — the patches are public. When Microsoft releases a fix, attackers can reverse-engineer the patch to figure out exactly what to exploit on machines that haven’t updated yet.

Not updating is like locking your front door but leaving the key in it.

The WannaCry Problem

In 2017, a vulnerability called EternalBlue was used to spread the WannaCry ransomware. It infected over 230,000 computers across 150 countries in a few days. Hospitals, businesses, government agencies — all hit.

Microsoft had released a patch for the vulnerability nearly two months before the attack.

Most of the businesses that got hit weren’t running ancient unsupported Windows. Mostly Windows 7 and Server 2008 R2 systems — the same versions many businesses were still running. They just hadn’t installed the update.

WannaCry didn’t care that you were busy. It didn’t care that the update prompt was annoying. It just encrypted everything and demanded $300 in Bitcoin.

The majority of successful ransomware attacks exploit known vulnerabilities with available patches. The gangs aren’t using fancy zero-days — they’re exploiting the updates people didn’t install.

“But Updates Break Things!”

This is the counter-argument, and it’s not wrong. Sometimes updates do break things. A driver stops working. An app compatibility issue pops up. Something that worked yesterday doesn’t work today.

This was more of a problem in the Windows 7/8 era. It still happens occasionally, but Microsoft has gotten significantly better at testing updates before broad release. The “update broke my computer” scenario is far less common than it used to be.

Here’s how to manage the risk without leaving yourself exposed:

Don’t install updates on day one. But don’t wait three months either.

Let the early adopters find the problems. Wait a week or so after “Patch Tuesday” (the second Tuesday of each month — that’s when Microsoft drops their big security updates). Then install.

You can configure this in Windows through Windows Update for Business or Intune (if you’re on M365 Business Premium). Set a deferral period — give feature updates a longer deferral (30-60 days), but keep security updates shorter (7-14 days).

How to Set Up a Basic Update Policy

If you’re running Windows 10/11 Pro (most business machines do), you can configure this without any extra tools:

1. Open Settings > Windows Update > Advanced options
2. Enable Receive updates for other Microsoft products (keeps Office updated too)
3. If available on your version of Windows, under Choose when updates are installed, set:
   • Feature updates: defer by 30 days
   • Quality updates: defer by 7 days

That’s the “set and forget” level. You’ll get security updates within a week of release (early adopters have found any problems by then) and feature updates within a month (plenty of time for news about any issues).

If you’ve got M365 Business Premium and Intune, you can do this centrally for all machines — more on that below.

If You’ve Got Intune (M365 Business Premium)

This is where it gets easier. When we covered M365 licensing, I mentioned that Business Premium includes Intune. One of the best things about Intune is centrally managing Windows updates across all your devices.

You create update rings — groups of settings that control when and how updates install. You can set up:

• A pilot ring: 5-10 machines get updates first. If something breaks, you catch it before it hits everyone.
• Everyone else: Gets updates 7-14 days after the pilot group.

The pilot ring should include non-critical machines and tech-comfortable staff who’ll actually report problems. Don’t put your most important server in the pilot group.

I’ve put together a complete walkthrough on Patreon for setting up Intune update rings — including recommended settings for small business, screenshots, and what to do if an update causes problems.

Other Things Updates Cover

It’s not just security. Updates also include:

• Bug fixes: That weird crash in Excel that happens every Tuesday? Might get fixed in a cumulative update.
• Driver updates: New hardware support and better performance on existing hardware (though these can occasionally cause issues, so some businesses manage them separately).
• .NET Framework updates: A lot of business software depends on this. Missing or mismatched .NET versions are a common cause of app issues.

The Bottom Line

I know updates are annoying. I know they always seem to fire at the worst time. But the alternative — running unpatched Windows in a business environment — is genuinely dangerous.

Configure a deferral so you’re not on day one. Test on a couple of machines first if you’re in a managed environment. But actually install them. Every month. Without fail.

The ransomware gangs are counting on you putting it off. Don’t make it easy for them.

For M365 Business Premium users, I’ve put together a step-by-step Intune update ring guide on Patreon — with recommended settings, pilot group setup, and rollback procedures if an update causes issues. Check it out here.

The email came from the boss’s actual email address. It looked real. The language was right. The urgency was convincing.

They paid $18,000 before anyone noticed.

This isn’t unusual. It’s happening every day, all over the world, to businesses just like yours. And it’s not because the criminals are genius hackers. It’s usually because the basics weren’t in place.

How Business Email Actually Gets Compromised

Forget the Hollywood image of a hooded figure typing furiously. Here’s what actually happens, in order of how common it is:

1. Stolen Passwords (The Big One)

Your password leaks in a data breach. It ends up on a list that gets sold on the dark web. Criminals use automated tools to try that same password on email, banking, accounting software — everything.

This is called credential stuffing, and it works because people reuse passwords. If your email password is the same one you used on that random forum in 2019 that got breached, your business email is one automated script away from being owned.

2. Phishing

Someone sends you an email that looks like it’s from Microsoft, your bank, or a supplier. There’s a link. You click it. You land on a fake login page that looks identical to the real one. You type in your username and password. You’ve just handed your credentials to a criminal.

Modern phishing is good. Really good. The fake pages are pixel-perfect. The sender addresses are close enough to fool you when you’re busy. The urgency (“Your account will be locked in 24 hours!”) pushes you to act before thinking.

3. No Multi-Factor Authentication

Even if they get your password, MFA stops them cold. But if you don’t have it enabled, a password is all they need. Full stop.

4. Session Hijacking

You log into email on a public Wi-Fi at a café. Someone on the same network could intercept your session token. They don’t need your password — they’re already “you” as far as the server is concerned.

Less common for small businesses, but it happens. Especially if you’re checking email at the airport, a hotel, or a coworking space.

What It Looks Like When You’re Compromised

You might not know right away. Sophisticated attackers don’t change your password (that would tip you off). They just quietly:

• Read your emails to learn how your business works, who your suppliers are, how you talk to your bookkeeper
• Set up email forwarding rules to send copies of certain emails to their own address (you won’t see this unless you check your settings)
• Send emails from your account to your contacts, your bank, your staff — whatever serves their purpose
• Access connected services — if your email is the recovery address for your bank, your accounting software, your domain registrar, they can reset passwords on all of them

The business I mentioned earlier? The attacker watched their inbox for almost a week before making a move. They learned the business’s patterns, who handled payments, what the boss’s writing style looked like. Then they struck.

How to Lock It Down

Here’s your action list. Do these in order.

Step 1: Unique Passwords Everywhere

Every account gets its own password. No exceptions. Use a password manager — Bitwarden (free) or 1Password (paid, excellent). Let it generate random passwords. You don’t need to remember them.

This single step eliminates credential stuffing entirely.

Step 2: Multi-Factor Authentication — Everywhere

I covered this in the security audit post, but it bears repeating: MFA is the single most effective security measure you can take.

Enable it on:

• Email (M365, Gmail, whatever you use)
• Online banking
• Accounting software
• Domain registrar (this one gets overlooked — if someone takes over your domain, they can intercept all your email)
• Cloud storage
• Social media

Use an authenticator app (Microsoft Authenticator, Google Authenticator, Authy) rather than SMS if possible. SMS is better than nothing, but it can be intercepted through SIM swapping.

Step 3: Check for Compromise Right Now

A few things to check today:

• Recent login activity. In M365, go to your account security page and check recent sign-ins. Look for locations or devices you don’t recognise. In Gmail, scroll to the bottom of your inbox and click “Details” under “Last account activity.”
• Email forwarding rules. Check if any rules are forwarding emails to an address you don’t recognise. In Outlook: Settings > Mail > Forwarding. In Gmail: Settings > Forwarding and POP/IMAP.
• Recovery email and phone number. Make sure your account recovery options actually point to your current email and phone number. Attackers often change these so they can regain access even after you change the password.

Step 4: Train Your Staff

This is the hard one. You can have the best technical controls in the world, but if your office manager clicks a phishing link and enters their credentials, the controls don’t matter.

You don’t need a corporate training program. You need a 10-minute conversation:

• Don’t click links in emails that ask you to log in. If Microsoft says your account is expiring, open a browser and go to microsoft.com directly. Don’t click the link.
• Verify payment requests. Any email asking for a bank transfer, especially if it’s “urgent” or “confidential” — verify by phone. Use a number you already have, not one in the email.
• Report weird stuff. If something feels off, tell someone. Don’t feel embarrassed. The businesses that recover fastest are the ones where staff speak up quickly.

Step 5: Have a Response Plan

If the worst happens, what do you do?

• Change passwords immediately — email first, then everything else
• Check forwarding rules and recovery options
• Notify your bank if there’s any chance financial accounts were accessed
• Notify your contacts — if the attacker sent emails from your address, let people know
• Check other accounts — if your email was compromised, assume any account that uses it as a recovery address is also at risk

Write this down. Don’t figure it out in the moment.

The Bottom Line

Email security isn’t complicated. It’s just unglamorous. Unique passwords, MFA, basic staff awareness, and knowing what to do if something goes wrong. That’s it.

The businesses that get hit aren’t the ones with bad luck. They’re the ones that never turned on MFA, never checked who had access, and never talked to their staff about phishing.

Don’t be that business.

I’ve put together a complete MFA rollout guide and staff awareness kit on Patreon — including step-by-step MFA setup for M365, a one-page staff handout on phishing, and an incident response checklist you can fill in with your own details. Get it here.

When was the last time you checked who still has access to your business email?

Do you know if your ex-employee’s laptop still has your files on it?

Could someone walk into your office right now and plug a laptop into your network?

If you hesitated on any of those, this post is for you.

Why Security Audits Get Ignored

Let’s be honest — nobody wakes up excited to do a security audit. It’s not fun. It doesn’t directly make money. And for a small business owner already wearing every hat, it’s the thing that gets pushed to next month every single month.

The problem is that “never” is how breaches happen. Not dramatic Hollywood hacking. Just someone reusing a password they leaked in a data breach three years ago, clicking a link in a voicemail redirecting as an email, or walking away from a computer that doesn’t lock.

Small businesses are the perfect target. You’ve got valuable data — customer details, bank access, supplier accounts — but you probably don’t have the security guardrails that a larger company has. Hackers know this.

The Audit — What to Check Right Now

Do all of these. Today, not tomorrow.

1. Who Has Access to What?

This is the big one.

• List every system your business uses. Email, accounting software, bank accounts, social media, file storage, your website, Point of Sale system — everything.
• For each system, list who has a login. Not just current employees. Former employees too.
• Remove anyone who shouldn’t have access. If “Jake from three years ago” still has admin access to your accounting software, that’s a problem.

Don’t forget:

• Shared Wi-Fi passwords (especially in hospitality/retail)
• Master accounts (the generic “admin” or “office” login everyone uses)
• Third-party access (your accountant, your web developer, your MSP)

If you don’t have a list, that’s problem one. Make the list. Fix it as you go.

2. Passwords — Get Serious

I know. Everyone hates this topic. But it’s still the number one way businesses get compromised.

• Are you reusing passwords? If your QuickBooks password is the same as your email password, and your email gets breached, the attacker now owns your finances.
• Are you sharing passwords? Shared Gmail inboxes, shared logins to the bank — these are common in small business. They’re also a nightmare when something goes wrong and you can’t tell who did what.
• Get a password manager. Bitwarden is free for a single user and has a cheap team plan. 1Password is another option. Either is better than the spreadsheet on Karen’s desktop called “logins.xlsx”.
• Prefer authenticator apps over SMS codes for MFA – SMS can be intercepted via SIM swapping. An authenticator app (like Microsoft Authenticator or Google Authenticator) is stronger protection.

The goal: every person has their own login. Every system has a unique password. Nobody’s writing passwords on a Post-it note stuck to their monitor. (You know who you are.)

3. Multi-Factor Authentication — Turn It On

If you only do one thing from this entire post, make it this.

Turn on multi-factor authentication (MFA) on:

• Email (M365, Gmail — whichever you use)
• Online banking
• Accounting software
• Cloud storage (OneDrive, Google Drive, Dropbox)
• Social media accounts
• Anything with customer data

MFA means even if someone gets your password, they still can’t log in without approving it on your phone. It blocks the vast majority of automated attacks.

Microsoft 365 makes this relatively straightforward — we covered MFA setup in a previous post. email me if you need help.

4. Backups — Test Them

We covered backups in a previous post, so I won’t rehash the whole thing. But the audit question is simple: When did you last test a restore?

If the answer is “never” or “I don’t remember,” your backups might not actually work. Backups that you haven’t tested are just hope with extra steps.

Pick a file from three months ago. Restore it. Confirm it works. Do the same thing next month. Build it into your routine.

Make sure at least one backup is offline or protected from deletion – ransomware that gets into your network can also wipe cloud backups.

5. Devices — What’s Connected?

Walk around your office. Count every device that connects to your network — computers, printers, phones, tablets, that random Raspberry Pi someone installed for a project two years ago.

Ask yourself:

• Are they all running current software? (Windows Updates, macOS updates, firmware on the router)
• Do they all have passwords/PINs?
• Do they lock automatically after a few minutes of inactivity?
• Are they encrypted? (BitLocker on Windows, FileVault on Mac)
• Is security software active on all devices? (Microsoft Defender is free and built into Windows)

That old Windows 10 machine in the back office that “still works fine”? It’s a liability. If it’s running an unsupported operating system, it has known vulnerabilities that will never be patched. Replace it or isolate it from the network.

6. Physical Security — The Forgotten Layer

You can have the best passwords in the world, but if someone can walk into your server room, none of it matters.

• Is your server cupboard locked?
• Do you have a guest Wi-Fi network separate from your business machines?
• What happens when a stranger walks in and says “I’m here to fix the printer”? (Social engineering is real — verify, don’t just trust)

This sounds paranoid until the day it isn’t.

How to Make It a Habit

Don’t try to fix everything in one day. Prioritise:

1. This week: Access audit and MFA everywhere. These are the highest-impact fixes.
2. This month: Passwords sorted, backups tested, device inventory done.
3. Ongoing: Quarterly review. Every three months, run through the checklist again. New employees, new devices, new software — things change.

The goal isn’t perfection. It’s raising the bar high enough that automated attacks move on to an easier target.

The Bottom Line

You don’t need a $50,000 security consultant or enterprise-grade tools. You need to spend a few hours going through a checklist and fixing the obvious stuff. Most small business breaches come from the same handful of basic failures — old passwords, no MFA, ex-employees who still have access, unpatched machines.

Fix the basics. You’ll be ahead of 80% of small businesses overnight.

Want a printable security audit checklist you can work through with timestamps and sign-off fields? I’ve put together a full template on Patreon — covering every point above with checkboxes, priority ratings, and quarterly review trackers. Grab it here.