Who do we call to keep our computers patched and updated?

Patching sounds like the most boring thing an IT provider does and it prevents more incidents than anything else on the list. Most successful attacks use vulnerabilities that were fixed months earlier on machines that never received the fix.

How we handle it: updates released to a small pilot group first so a bad patch is caught on two machines rather than forty; scheduled outside your business hours, and outside your busy season entirely if you have one; applications patched as well as Windows, since browsers, PDF readers and Java are attacked at least as often; and compliance reported per machine rather than as an aggregate percentage that hides the three servers nobody touched.

That last detail is worth insisting on with any provider. A reported figure of 97 percent compliance sounds excellent and can mean your domain controller has not been patched since March.

Where a vendor forbids updating, which happens with imaging and industrial equipment, we document the exception and isolate that machine on the network rather than leaving it exposed and hoping.