Updates close doors that are already known
Most attacks on devices use flaws that were fixed months earlier. Automatic updates remove the gap.
Why “later” is the risky answer
When a vendor publishes a fix, the description of the flaw becomes public too. From that day the flaw is easier to exploit, and every device that has not installed the fix is a known target. Postponing an update keeps you in that group.
Let updates install themselves
Turn on automatic updates for the operating system, the browser and your apps, and restart when asked. A browser that has been open for three weeks is still running the old version, even if the new one was downloaded.
Do not forget the quiet devices: the home router, the printer, the phone you use for sign-in codes. If a device no longer receives updates from its maker, plan to replace it.
Update notices that are not updates
A real update comes from the system settings or the app store. A web page or a pop-up that says your browser or player is out of date and offers a download is a common way to deliver malware. Close it and check for updates in the settings instead.
This note is our own plain-language summary. For the full guidance, read the original: https://www.cisa.gov/secure-our-world/update-software
A real update never arrives as a pop-up on a web page.