CYBER ESSENTIALS
Cyber Essentials Security Update Management
Keep supported software secure - and fix serious vulnerabilities quickly
Security Update Management is one of the five Cyber Essentials technical controls. Its purpose is to reduce the opportunity for attackers to exploit known vulnerabilities in the software and devices your organisation relies upon.
Cyber Essentials requires in-scope software to be licensed and supported, with applicable high-risk and critical security fixes applied within 14 days of release.
That sounds simple. In practice, organisations first need to know what software they have, which versions are installed, whether those versions remain supported, what vulnerabilities affect them and whether an appropriate vendor-approved fix is available.
The difficulty increases as applications, operating systems, devices and vulnerabilities continually change.
SecureX7 automates much of this visibility by discovering assets and installed software, identifying vulnerabilities and highlighting conditions requiring attention.
Rather than presenting another overwhelming vulnerability list, SecureX7's AI-powered actionable guidance provides context, helps establish what matters and explains the remediation that should be considered.
This turns security updating from a periodic patching exercise into a continuously assessed security control.
Know what's vulnerable. Know what matters. Know what to fix.
What Security Update Management Covers
Cyber Essentials requires organisations to maintain in-scope software throughout its supported lifecycle.
That includes operating systems, applications, browsers, server software, firmware and other software running on devices within the assessment scope.
Software must be licensed and supported by the supplier. When a product or version reaches end of support, it should be removed, upgraded or otherwise addressed so that unsupported software does not remain within scope.
Security fixes must also be applied promptly.
Where a vendor identifies a vulnerability as critical or high risk—or where the vulnerability has a CVSS v3 base score of 7 or above—an applicable security fix must be installed within 14 days of release.
A vulnerability fix is not necessarily a traditional software patch. Depending on the vendor's guidance, it could include an update, configuration change, registry change, script or another vendor-approved remediation.
Effective Security Update Management therefore requires more than simply enabling automatic updates.
You need to understand:
What you have → whether it is supported → what vulnerabilities affect it → whether a fix exists → whether remediation has been completed on time.
That requires accurate and continuously maintained visibility across the estate.
Common Security Update Problems
Security Update Management frequently becomes difficult because organisations lack complete visibility rather than because they deliberately ignore security updates.
Unknown software
You cannot update applications you don't know are installed.
Unsupported products
Legacy applications and operating systems can remain in use after the vendor stops providing security fixes.
Application patching gaps
Windows may be fully updated while browsers, utilities and third-party applications remain vulnerable.
Missed devices
Remote laptops, rarely used machines and other endpoints can fall outside normal update processes.
No vulnerability context
A long list of missing updates doesn't necessarily show which issues require action within the Cyber Essentials 14-day window.
Remediation without verification
A patch may have been approved or deployed without confirming that every affected device was successfully remediated.
SecureX7 combines asset, software and vulnerability visibility to help expose these gaps.
Its AI-powered actionable guidance helps teams understand the significance of identified weaknesses and determine appropriate remediation, while continued assessment can verify whether exposure remains.
The objective is not simply to install more patches.
Find the vulnerabilities that matter, remediate them within the required timeframe and verify that the risk has actually been addressed.
Related Guidance
Security Update Management connects asset visibility, vulnerability management and remediation. These guides explore the areas most likely to affect Cyber Essentials readiness.
The Cyber Essentials 14-Day Security Rule
Understand which vulnerabilities need action within 14 days, when the clock starts and what Cyber Essentials considers an acceptable security fix.
Explore the 14-Day Security Rule →
Unsupported and End-of-Life Software
Learn how unsupported operating systems and applications can affect Cyber Essentials and how to identify software approaching end of support.
Explore Unsupported Software →
Software & Asset Inventory
You cannot maintain software you don't know exists. Understand how accurate asset and software inventories support Cyber Essentials compliance.
Explore Asset Discovery →
Secure Configuration
Not every vulnerability is resolved with a conventional patch. Vendor-approved configuration changes can sometimes form part of the appropriate remediation.
Explore Secure Configuration →
SecureX7 brings these disciplines together: discovering assets, identifying installed software and vulnerabilities, prioritising exposure and providing AI-powered actionable remediation guidance.
Discover. Prioritise. Remediate. Verify.
