Software updates and patching

A huge share of real-world breaches exploit a vulnerability that already had a fix available, the update simply hadn't been installed yet. Software updates aren't just new features, they very often close specific security holes that attackers are actively scanning for.

What this means in practice

Enable automatic updates wherever practical, for the operating system, browser, and any software that handles sensitive data. Delaying an update because it's inconvenient at that moment is a genuine, measurable increase in risk, especially for internet-facing software like browsers, email clients, and VPN software.

Devices and software that are no longer supported by their vendor stop receiving security fixes entirely, and become a growing risk the longer they're kept in use past that point.