Once a month, spend ten minutes confirming automatic updates are on, installing anything that is waiting, removing apps you no longer use, and replacing software that no longer gets security fixes. Keep a short list of what you run. That covers most of what CISA advises for everyday users.
Why monthly
Flaws are found all the time, and attackers often use known ones. CISA calls keeping software current the most effective measure you can take. Automatic updates handle most of it, but not everything updates itself, so a monthly sweep catches the rest.
The routine
| Minute | Task | What to look for |
|---|---|---|
| 1 to 2 | Check automatic updates | Are they on for the system and for key apps? CISA recommends them where offered |
| 3 to 4 | Open the system update screen | Anything waiting? Install it |
| 5 to 6 | Open the apps that do not update themselves | Use each app's own update menu |
| 7 | Delete unused apps and browser add-ons | Fewer parts means fewer flaws |
| 8 | Spot software with no support | CISA advises retiring end-of-life software |
| 9 | Review the short list | Add new software, remove old |
| 10 | Check that you update from a trusted network | CISA advises against hotel and airport networks |
The short list
Keep a note, on paper or in a file, with five columns: product, version, where it came from, whether it updates itself, and when support ends if known. Ten to twenty rows are enough for most households. For a small business it can be a spreadsheet, and larger organizations keep it in a tool.
What to do with findings
- Update waiting: Install it now.
- No automatic updates: Turn them on, or put a reminder in your calendar.
- Unsupported software: Plan a replacement, then retire it.
- A pop-up or email urging an update: Ignore it and go to the app. CISA warns that attackers use fake update files.
- An app you do not remember installing: Investigate or remove it.
Rules of thumb
- Prefer official stores and vendor sites.
- Do not follow update links in emails.
- If an app has not been updated for a long time, check whether it is still supported.
- Back up what matters before big updates.
What this routine will not catch
It will not tell you about flaws in components inside an app that the vendor has not yet fixed. For that you depend on the vendor, which is why a vendor's update habits are worth knowing before you choose a product.
Where Safeguard fits
At work, the same monthly idea applies to your code. Safeguard keeps an inventory of components through dependency scanning and SBOMs, flags new advisories continuously, and uses policies and gates to keep risky components out. Try the free scan at gold.safeguard.sh/scan.
Quick check
Is monthly often enough?
With automatic updates on, yes for most people. Check sooner when a major flaw is in the news.
What counts as end-of-life software?
Software that its maker no longer supports with security updates. Check the vendor's product page for a support end date.
Sources
Last reviewed: 19 October 2026.
