A real update reaches you through the app's own update setting, your device's update screen, or the vendor's official website that you typed or bookmarked yourself. A pop-up in a browser tab, a text, or an email link that says "update now" is not that. Treat it as suspect until you check.
Why attackers fake updates
Updates are the one thing everyone has been told to install. That makes a fake update an easy disguise. CISA's guidance on patches says to download updates only from trusted vendor sites and not to trust links in emails, because attackers use fake update files.
The risk is not only the file you click. It is also the habit. If you are trained to click "update" on anything that looks urgent, you will eventually click the wrong one.
Where real updates come from
| Source | Usually safe? | What to do |
|---|---|---|
| The app's own Settings, About or Check for updates menu | Yes | Use this first |
| Your phone or computer's built-in update screen | Yes | Open it yourself, not from a link |
| The vendor's official site, reached by a bookmark or typed address | Yes | Download from the downloads page |
| An email, text or chat message with an update link | No | Ignore the link, go to the app instead |
| A browser pop-up saying your software is out of date | No | Close the tab, do not click inside it |
| A site offering a "free faster" copy of a paid app | No | Do not install |
What to do when a prompt appears
- Stop. Do not click anything in the pop-up or message, including "Cancel" buttons that may also be links.
- Close the browser tab, or delete the message.
- Open the app directly and look for its own update option. Most apps show update status in Settings or About.
- If the app says it is current, the prompt was fake.
- If you already ran something, disconnect the device from the network and tell whoever manages your IT. At home, run a scan with the security tool your device already trusts and change passwords for important accounts from a different device.
Signs a prompt is fake
- It appears while you are reading a web page, not inside the app itself.
- It pushes urgency, such as a countdown or a warning that your device is infected.
- The file name or the web address is slightly off from the vendor's real one.
- It asks you to turn off a security feature before installing.
- It arrives by email or text you were not expecting.
None of these alone proves a fake, but any one is a reason to go to the app and check there.
Update on a trusted network
CISA also advises applying automatic updates from a trusted network such as home or work, and avoiding untrusted networks like hotels or airports. If you have to update on the road, it suggests connecting through a VPN to a trusted network first.
Where Safeguard fits
This is mostly a personal habit, but the same idea applies to teams: updates for the components inside your own software should come from trusted sources and be checked. Safeguard scans your dependencies, builds an SBOM and lets you set policies and gates on what is allowed in. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Is a "Your browser is out of date" banner ever real?
Almost never. Browsers update through their own settings or the operating system. A banner inside a web page is page content, not your browser talking, so close the tab and check the browser's own update screen.
I clicked an update link in an email. What now?
If you only opened the page, close it and do not enter anything. If you downloaded or ran a file, disconnect from the network, tell your IT contact, and change important passwords from another device.
Sources
Last reviewed: 19 October 2026.
