Cybersecurity Foundations (Grades 6–8) · lesson 34 of 48 · 8 min
The Race Between Patches and Attackers
Every piece of software has vulnerabilities — flaws in the code that attackers can exploit. When a vulnerability is discovered, a race begins: the developer races to release a patch, and attackers race to exploit the vulnerability before users update. The window between a vulnerability being discovered and a patch being applied is called the vulnerability window — and it is when you are most at risk.
Keeping software updated is one of the single most effective security actions you can take. It costs nothing and takes minutes. Yet millions of devices remain unpatched for months or years.
By the end of this lesson you will be able to explain why security patches are critical, identify which devices need updating (including forgotten ones), compare automatic and manual update strategies, and understand what firmware is and why it matters.
The vulnerability window
Security researchers have found that attackers begin scanning for unpatched systems within 15 minutes of a vulnerability being publicly disclosed. Within 24 hours, automated exploit tools are circulating. Within a week, mass exploitation campaigns are underway. The faster you patch, the smaller your window of exposure.
Why Updates Are a Security Tool
Most people think of software updates as adding new features. But the most important updates are security patches — fixes for vulnerabilities that attackers could exploit to take control of your device, steal your data, or install malware.
When a vulnerability is discovered, a race begins: the software developer races to release a patch, and attackers race to exploit the vulnerability before users update. Keeping software updated is one of the single most effective things you can do to protect yourself.
Types of Updates
What Gets Updated — and What People Forget
Most people remember to update their phone and computer. But many devices that connect to the internet are forgotten:
The forgotten attack surface
Researchers have found that the average home has 10–15 internet-connected devices. Most people update their phone and laptop but never update their router, smart TV, or security camera. Attackers specifically target these forgotten devices to gain a foothold in home networks.
Automatic vs Manual Updates
Knowledge Check
Security Updates
What is a security patch?
- A new feature added to software
- A fix for a vulnerability that attackers could exploit
- A backup of your system files
- An antivirus scan
Answer: A fix for a vulnerability that attackers could exploit
Security patches close specific vulnerabilities. Applying them quickly is critical because attackers actively exploit unpatched systems.
The WannaCry ransomware attack in 2017 infected 200,000 computers. What was the main reason so many were affected?
- The antivirus software failed
- Users had clicked phishing links
- The machines were running unpatched Windows despite a fix being available
- The attack used a zero-day vulnerability with no patch
Answer: The machines were running unpatched Windows despite a fix being available
Microsoft had released a patch two months before WannaCry. Every infected machine was unpatched. This is why timely updates are critical.
Routers and smart home devices rarely need security updates.
- True
- False
Answer: False
Routers and IoT devices run software with vulnerabilities just like computers. They are frequently targeted because users rarely update them.
For which software should you enable automatic updates?
- Only the operating system
- Only the browser
- Operating system, browser, and antivirus at minimum
- No software — manual updates give you more control
Answer: Operating system, browser, and antivirus at minimum
These three are the most critical attack surfaces. Automatic updates ensure patches are applied immediately without relying on you to remember.
The software embedded in hardware devices like routers and printers is called _____.
Answer: firmware
Firmware is the low-level software that controls hardware. Router firmware vulnerabilities are a common attack vector that is frequently overlooked.
Real-World Case Studies
Case 1: Equifax — A $700 Million Patch Failure
In 2017, Equifax (one of the three major US credit bureaus) suffered a breach that exposed the personal data of 147 million Americans — including Social Security numbers, birth dates, and addresses. The cause: a known vulnerability in Apache Struts (a web framework) that had been patched two months earlier. Equifax’s IT team had failed to apply the patch. The breach cost Equifax $700 million in settlements and destroyed the company’s reputation. The lesson: patch management is not optional — it is a fundamental security control. Failing to patch known vulnerabilities is negligence.
Case 2: The Mirai Botnet — IoT Devices Never Updated
In 2016, the Mirai botnet infected 600,000 IoT devices — security cameras, DVRs, and routers — by exploiting default credentials and unpatched firmware. These devices were then used to launch the largest DDoS attack in history, taking down major websites including Twitter, Netflix, and Reddit for hours. Most of the infected devices had never received a firmware update since they were manufactured. The lesson: every internet-connected device is a potential attack vector. Firmware updates and changing default passwords are essential.
Previous lesson: Reporting suspicious content
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Backups and recovery