Usually no. Switching updates off trades a rare risk, a malicious update, for a common one, running known vulnerable software. A better default is staged updates: a short delay, a pilot group, monitoring, and a quick rollback path, with a fast lane for urgent security fixes.
What a malicious update is
A malicious update is a bad release delivered through the channel you already trust. The cause can be an upstream build compromise, a hijacked publisher account or a vendor mistake. The CISA alert on the xz library states that malicious code was embedded in versions 5.6.0 and 5.6.1 and recommends downgrading to an uncompromised version such as 5.4.6. Note the advice: roll back, hunt, report. That only works if you know where the version is and can change it.
The trade off
| Policy | Protects against | Leaves you open to |
|---|---|---|
| Update immediately | Known vulnerabilities | Fresh malicious releases |
| Never update | Fresh malicious releases | Known vulnerabilities, growing over time |
| Staged update | Most fresh malicious releases, and known vulnerabilities after a short wait | Very fast exploitation inside the delay window |
A practical policy
- Split by risk. Developer tools, build dependencies and production runtime each get their own rule. Build tooling with broad access deserves the slowest, most careful path.
- Delay routine updates. Hold new versions for a short, fixed period before they reach everyone.
- Pilot first. Send updates to a small group or one environment and watch behavior.
- Keep an urgent lane. When a vulnerability is being actively exploited, shorten the delay and apply the fix quickly.
- Keep rollback ready. Know the last good version and how to deploy it.
- Watch behavior. Unexpected network connections or new processes after an update are the real signal.
Who this does not cover
Consumer devices often update on their own schedule, and turning updates off there is rarely wise. This guide is for teams that manage dependencies and software they deploy.
Try it yourself
Open the demo for a fix that is available now, and see how the choice between taking a fix and waiting is presented with the evidence beside it.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard offers dependency scanning, policies and gates, and autonomous remediation with fix PRs, which is off by default with every category on Manual, so a person approves each change. Run a free scan to see which updates apply to a project.
Quick check
How long should an update delay be?
There is no universal number. Pick a short period you can defend, and shorten it for actively exploited vulnerabilities.
Is pinning the same as turning updates off?
Pinning fixes a version until you choose to change it. It is fine if you review and update on a schedule.
Sources
Last reviewed: 19 October 2026.
