In 2025, 48,185 security flaws in software were given a public reference number and published. That is about 130 a day, and a fifth more than the year before (Jerry Gamblin).
The reference is called a CVE, short for Common Vulnerabilities and Exposures. When someone finds a weakness in a program that an attacker could use, it gets a number made of the letters CVE, the year and a serial number. That way the maker and everyone who runs the program know they mean the same flaw. Each CVE is a known hole, published for anyone to read, attackers included.
The count keeps rising, and AI is part of the reason: it has made finding flaws quicker and cheaper. In April I wrote about Anthropic’s Mythos model, and the sceptics’ strongest point was that open-source models roughly 250 times smaller, costing pennies to run, found the same flaw Anthropic had shown off. If finding flaws is cheap for researchers, it is cheap for criminals as well.
Nobody running a small business can read 130 security notices a day, and nobody should try. The better question is who in your business decides which of them matter to you.
Nobody’s Problem Until It Breaks
In most small businesses I meet, the honest answer is nobody.
The government’s own figures point the same way. In the Cyber Security Breaches Survey 2025/26, 43% of UK businesses had a breach or attack in the previous twelve months, yet only 31% had someone at board level responsible for cyber security (gov.uk).
The owner carries the risk whether or not anyone is watching. If an attack stops the business, the owner answers for it. So the job needs a name against it. That can be someone on your team, or it can be someone like me. It can’t be nobody.
A Factory That Couldn’t Just Upgrade
One of my clients is a twelve-person manufacturer of metal parts near Milton Keynes. More than anything, the machines in the workshop have to keep running.
When I started working with them:
- The software that drives the machines no longer gets security updates. Its maker has replaced it with a newer product, but because of the machines they own, they can’t just upgrade. They are stuck on the old version.
- The office computers ran Windows 10. They were too old for Windows 11, and nobody wanted an upgrade that might stop the workshop software working.
- The accounts ran on a version of Sage that was out of date.
- Microsoft 365, bought only for the people who need it, handled email and file storage.
The owner is accountable for all of it and, until then, had not thought much about what a cyber attack could do to the business. When we thought it through together, their worry was the workshop stopping, more than any criminal gang singling them out.
Run Less
Every program on a computer can have flaws, and every program needs updating. The less you run, the less there is to attack and the less there is to look after. Security people call this reducing your attack surface.
At the factory:
- One computer now does nothing but serve the workshop. It is not on the network and cannot reach the internet. It still runs Windows 10 and the old machine software, because it has to, but I rebuilt it on a stripped-down Windows 10 with everything removed that the machine software doesn’t need. There is no email on it, and no files except the ones production needs.
- Files reach it on a USB stick. That is a bit tedious, but it is manageable, and it is a much smaller risk than a network connection. The stick is scanned for viruses on the office computer and again on the workshop computer. The workshop computer can’t fetch new virus definitions by itself, so unless someone updates it by hand, its scanner can only look for suspicious behaviour. The office computers have fully up-to-date scanners and check the files first.
- The office computers moved to a stripped-down Windows 11, with everything they don’t use switched off. A lean system also asks less of old hardware, which puts off the day they need new computers.
- Nobody has Outlook or Word installed. They use Microsoft 365 in the browser only, in Microsoft Edge, whose SmartScreen filter warns about and blocks known malicious websites and downloads. Two-step sign-in, a second check on top of the password, is switched on for everyone.
A warning about the stripped-down Windows: I build those with specialist tools, fitted to what each client runs. Get it wrong and Windows can stop updating or stop working, so please don’t try it yourself.
The same goes for websites. My hosting service, Static Host UK, looked at WordPress: of 11,334 new WordPress flaws found in 2025, six were in WordPress itself. The rest came with the plugins and themes people add (Static Host UK ).
Let Security Updates Install Themselves
When a flaw turns up in software you use, the fix comes from its maker, and it only protects you once it is installed. So let your computers install security fixes themselves, as soon as they arrive.
Windows has two kinds of update. Security updates fix flaws. Feature updates change how Windows works, and they are where an old program is more likely to stop working. At the factory:
- Windows installs security updates as soon as they come out.
- Feature updates are switched off. Once a year we review whether one is needed. Most likely they will stay on the version they have until it stops getting security updates, and only then upgrade.
- The computers used for design are online, and their design software updates itself. It has no setting for security updates only, but for them that is fine.
- Sage is now on a version its maker still supports.
The workshop computer is the exception, and it shows what to do when updates are not possible. For businesses, Windows 10 stopped getting free security updates in October 2025. Microsoft will sell up to three more years of them, at a price that doubles each year (Microsoft). The workshop software can’t move, so the computer it runs on is cut off instead.
Updates are one layer and backups are another. Everything at the factory is backed up on the 3-2-1 rule, which I run for them: three copies of the data, on two different kinds of storage, with one kept somewhere else. If an update or an attack goes wrong, they can get their data back. There is more on backups in The Onion Strategy.
Check Who Wrote Your Software
Every program you install and every online service you sign up to puts some of your security in someone else’s hands. At the factory that means Microsoft, Sage and the company behind the workshop software. Each maker’s mistakes become yours.
Hardly anyone checks. The same government survey found that only 12% of micro businesses and 22% of small ones look at the cyber security risks their immediate suppliers pose.
For my clients I run the checks myself. I start from the National Cyber Security Centre’s questions to ask suppliers and add what experience has taught me. Before you buy, find out about:
- History: how long has the company been around, and what has it done?
- Ownership: who owns it, and has that changed recently?
- Conflicts of interest: do its owners or backers have reasons to put something ahead of your security?
- Its record on flaws: how many have been found in its products, how serious were they, and how quickly were they fixed?
- Who answers for security: is a named person responsible?
- Attitude: how does it talk about security, and when it had a breach, did it own up and fix it, or play it down?
None of these needs technical knowledge. Most of the answers are a search away, and a supplier that won’t answer them has told you something too.
The Bottom Line
Nobody can keep up with 130 new security flaws a day, and a small business doesn’t need to. It needs one person whose job it is to decide which ones matter, and three habits: run as little software as you can, let security updates install themselves, and check who you buy from. Where a computer can’t be updated, cut it off from everything it doesn’t need.
Put a name against the job. If you would rather it wasn’t yours, it can be mine.
What’s Your Experience?
Who installs the updates on your business’s computers, and when did anyone last check? Tell me through social media.
If the answer is nobody, book a call and we can work out who it should be.
Photo by Christian Erfurt on Unsplash
