It is better to wait. CISA advises applying updates from a trusted network, such as your home or workplace, and avoiding untrusted networks like hotels or airports. If an urgent update cannot wait, connect through a VPN to a trusted network first, then update.
Why the network matters
An update is a file delivered over a network. On a network you do not control, someone else may be able to watch or interfere with traffic, or set up a lookalike network to catch devices that connect. Well built update systems defend against this with signed updates and encrypted connections, but not every app is well built, and you cannot see from the outside which kind you have.
Waiting for a trusted network removes a layer of doubt at almost no cost.
What CISA says
CISA's guidance recommends automatic updates where available and says to apply them from trusted networks, avoiding hotels or airports. If you must update on an untrusted network, it suggests connecting through a VPN to a trusted network first. It also says to download updates only from trusted vendor sites and not to trust links in emails.
A decision table
| Situation | What to do |
|---|---|
| Routine update, you are at home or work | Install normally |
| Routine update, you are at a hotel or airport | Wait until you are on a trusted network |
| Urgent security update, flaw is being exploited | Use a VPN to a trusted network, then update, or tether through your phone |
| Update prompt appears in a browser tab | Ignore it and use the app's own update menu |
| Update arrives by email link | Do not click, check the app directly |
| You are not sure the network is real | Treat it as untrusted |
Practical steps before you travel
- Update your phone, laptop and key apps the day before you leave, from home.
- Turn on automatic updates so they run when you are back on a trusted network.
- Set your device to ask before joining open networks.
- Know whether your workplace offers a VPN, and how to use it.
- Keep a mobile data connection as a backup, since your phone's own network is generally a safer path than shared Wi-Fi.
What this does not fix
Waiting protects the delivery of the update. It does not protect against a flawed update, a stolen developer account, or a bad component inside a legitimate app. Those need other defenses, such as official sources and keeping software current.
Where Safeguard fits
If you ship software, the same worry applies to the components you pull during builds. Safeguard scans dependencies, builds SBOMs and lets you set policies and gates on what can enter a build. Free scan: gold.safeguard.sh/scan.
Quick check
Is a VPN enough to make any update safe?
CISA suggests it as a way to reach a trusted network when you cannot avoid an untrusted one. It does not make a bad update good, so keep using official sources.
Should I postpone a critical update until I am home?
If a flaw is being exploited, do not wait long. Use a trusted connection such as a VPN to your home or work network, or your phone's own connection.
Sources
Last reviewed: 19 October 2026.
