For most products, allow automatic security updates but control the timing: a small pilot group first, the rest after a short delay. Switch to manual approval for systems where a bad update would be costly, and always know how to pause or roll back.
The trade
Automatic updates remove the slowest step in patching, which is waiting for a human to act. CISA's Secure by Demand guide asks whether manufacturers make patches easy to install and enable automatic updates. Both are signs of a vendor who wants customers patched.
The cost is trust. An automatic update runs vendor code in your environment with little review. If the vendor's build or update channel is compromised, your fleet receives the bad update at the same speed as a good one. Our post on software update signing covers how signatures reduce this risk, and the 3CX case shows their limits.
Decision guide
| Situation | Suggested approach |
|---|---|
| Endpoint tools, browsers, office suites | Automatic, with a short delay and a pilot ring |
| Internet facing servers with exploited flaws | Fast track, manual push within your emergency tier |
| Production systems with strict change control | Manual approval, scheduled windows |
| Safety or availability critical systems | Manual, tested in a staging copy first |
| Products with no rollback | Manual, and ask the vendor how to recover |
Staged rings in practice
- Ring 0: the IT team and a few volunteers. Updates land first.
- Ring 1: a sample of ordinary users, after a day or two.
- Ring 2: everyone else, after the observation period passes without problems.
- Emergency path: skip rings when a flaw is exploited and the fix is known, with approval from the product owner.
Pick the delays with your own risk in mind. A longer delay lowers update risk and lengthens exposure. NIST SP 800-40 Rev. 4 describes grouping assets into maintenance groups so that updates follow a plan. Rings are a simple version of that idea.
Questions to ask the vendor
- Can we control timing, pause, or opt out per group?
- Are updates signed, and how do we verify them?
- Can we roll back, and how far back?
- Do security updates arrive separately from feature changes?
- How do you announce an update that was withdrawn?
What to write down
For each product: the update mode, the ring, the owner, who can pause it, and the rollback steps. Test the pause button once before you need it.
Quick check
Are automatic updates safe?
They speed patching but give the vendor power over your systems. Use signed updates, rings and a way to pause.
When should updates be manual?
On systems where a bad update costs more than a short delay, and where no rollback exists.
Safeguard's continuous monitoring helps you see which versions are installed across your estate, so you can tell whether a ring has actually updated.
Sources
Last reviewed: 19 October 2026.
