Lock the Doors: AI Security Basics for a Small Office · Lesson 2 of 7

Updates that run themselves

25 minutes. Automatic beats monthly. Every time.

---

If attackers can move in a day, the best patch routine is the one that doesn't wait for a person. This lesson turns on automatic updates everywhere they exist, then gives everything else on your Front-Door List an owner and a weekly check.

Accept one small cost up front: automatic updates sometimes reboot a machine at an awkward time. That's the price of the window closing by itself. Set "active hours" or a restart schedule so it happens at night, and move on.

Part 1: The computers (10 minutes)

Windows 11

Microsoft's help page says Windows 11 downloads and installs updates automatically. Your job is to make sure nobody switched that off or paused it and forgot.

  • Go to Start, then Settings, then Windows Update.
  • If you see that updates are paused, resume them.
  • Set active hours (the times you're usually working) so restarts happen outside them.

Microsoft notes you can pause updates for a while but can't stop them entirely. If a machine shows it hasn't updated in a long time, tell your IT partner. Something is blocking it.

Mac

  • Open System Settings, then General, then Software Update.
  • Select the info button (the small "i") next to Automatic Updates.
  • Turn on Download new updates when available, Install macOS updates, and Install Security Responses and system files.

Apple notes that laptops need to be plugged in for automatic downloads, so a MacBook that lives on battery may fall behind. Plug it in overnight once a week.

Browsers and phones

Modern browsers download their own updates, but an update often isn't finished until the browser restarts. The problem is the browser that's been open for three weeks with forty tabs. Tell the team: once a week, close the browser all the way and reopen it. Phones: turn on automatic updates in the phone's settings, and accept the overnight install.

Part 2: The website (5 minutes)

If your website runs on WordPress, its plugins are on your Front-Door List, because anyone on the internet can reach your site. Since WordPress 5.5 you can turn on automatic updates plugin by plugin.

  • Log in to your site's admin area and go to the Plugins screen.
  • There's an Automatic update column. Select the action link to enable auto-updates for each plugin, or select several plugins, choose the bulk action to enable auto-updates, and select Apply.
  • Do the same for your theme from the Appearance screen.

WordPress recommends having backups you can roll back to before you turn this on. If you don't know whether your site is backed up, that's a question for whoever built or hosts it. If your site is on a hosted builder (Squarespace, Wix, Shopify and similar), the company generally keeps the platform itself updated. Your job there is to remove apps and add-ons nobody uses.

If you don't know what your website runs on, write "ask web person" in the Owner column and send them one question: "Are the site and all its plugins set to update automatically, and is there a backup?"

Part 3: The front doors that need a person (5 minutes)

Firewalls, routers, VPNs and remote access tools are where the attack window matters most, and where auto-update settings vary the most by brand. I can't give you one click path for all of them, so here's what to look for:

  • Log in to the device's admin page (or ask whoever can) and look for a section named something like "Firmware," "System update," "Auto-update" or "Maintenance."
  • If there's an automatic option, turn it on, with a restart window at night.
  • If there isn't, that device gets a named owner and a weekly look. Not monthly. Weekly.
  • If your IT partner manages these, you don't need to log in at all. You need one sentence from them, in writing: "Every item on your Front-Door List is checked for updates weekly, and critical fixes are installed within [a few] days." The article [Attackers Now Move in a Day](https://appliedaiinsider.com/articles/patch-window-one-day) suggests asking for exactly that, on a weekly cycle rather than "at the next maintenance window."

The remote access tool deserves its own line. It's the software that lets someone reach every computer in your office from outside. The BeyondTrust flaw from Lesson 1 was in exactly this kind of tool. Ask your IT partner which one they use and whether it's on the latest version today.

Part 4: AI tools that can take actions (5 minutes)

Go down Part 2 of your Front-Door List. For each AI tool, ask one question: can it do things, or only answer questions?

  • Answers only (a chat window in the browser that isn't connected to anything): the vendor updates it on their side. Owner: whoever pays for it. Routine: none needed beyond your account security (Lesson 4).
  • Desktop apps (the Claude, ChatGPT or Copilot apps installed on a computer): most check for updates on their own or offer an update when you open them. Open each one's settings or "About" screen once, and make sure it isn't stuck on an old version.
  • Can take actions (connected to email, files, accounting or a browser, or able to run tasks on its own): give it a named owner who checks it weekly and reads any update notes from the vendor.
  • Something someone runs themselves (a local AI model server or an agent builder on a work machine or a cloud account): these don't update unless a person updates them. Lesson 5 is about finding these.
Do this now: finish the Owner and Update columns

Open your Front-Door List and, for every row in Parts 1 and 2:

  • Write the Owner: one name, a real person. "IT partner" is fine if it's their job and they've agreed.
  • Write the Update routine: "Automatic" (and the date you confirmed it), or "Checked weekly by [name] on [day]."
  • Circle any row where nobody's name fits. Each circle is a door with no one watching it. Send those rows to your IT partner today with the note: "Can you own these, or tell us who should?"

Check it worked

  • Every computer you've touched shows automatic updates on and nothing paused.
  • Every row on the Front-Door List has a name and a routine, or is circled and sent to someone.
  • Nothing on the list says "monthly."

---

Next: the computers themselves. Which AI apps on them can see everything?

→ Lesson 3: What your AI apps can see on each computer

Previous: Why the attack window shrank · Next: What your AI apps can see on each computer