Why software updates matter, and how to turn them on for every device you own

Software has bugs, and some bugs let an attacker run code on your device, read your data or bypass a lock screen. When a company finds or is told about one, it fixes it and ships an update. The release notes often say little, but researchers and criminals can compare the old and new versions to work out what was broken. From that moment, every unpatched device is a known target.

A zero-day is a flaw attackers are exploiting before the maker has a fix. When Apple, Google or Microsoft patches one, the note usually says the issue "may have been actively exploited." Those are the updates to install the same day. The US Cybersecurity and Infrastructure Security Agency keeps a public catalog of known exploited vulnerabilities if you want to see how often this happens: the list is long and grows every week.

You do not need to read any of it. Automatic updates handle the routine, and a habit of restarting when your phone or laptop asks handles the rest.

iPhone and iPad

1. Open Settings > General > Software Update.
2. Tap Automatic Updates and turn on both downloading and installing iOS updates, plus Security Responses & System Files.
3. For apps: Settings > App Store, turn on App Updates.

Automatic installs usually happen overnight while the phone is charging and on Wi-Fi, so a phone that is never plugged in at night may lag behind. Check the Software Update screen every few weeks.

Android

Android updates come from three places, and menu names vary by maker:

• System and security updates from the phone maker. Look under Settings > System > Software update on a Pixel or Settings > Software update on a Samsung. Turn on automatic download where offered.
• Google Play system updates. These patch core parts of Android through Google. On many phones they sit under Settings > Security & privacy > System & updates, or search Settings for "Google Play system update."
• App updates through the Play Store: tap your profile picture, then Settings > Network preferences > Auto-update apps.

The security patch date matters more than the Android version number. You can see it in Settings > About phone (sometimes under Android version). If it is many months old and no update is offered, your phone may be past its support window.

Windows 11

Go to Settings > Windows Update. Updates install automatically by default; your job is not to pause them indefinitely and to let the PC restart. Under Advanced options, turning on "Receive updates for other Microsoft products" also patches Office. Set active hours so restarts happen when you are not working.

Mac

Go to System Settings > General > Software Update and click the info button next to Automatic Updates. Turn on everything, including Install Security Responses and system files. App Store apps update from the same screen's options; apps from other sources usually have a "Check for updates" item in their own menu.

Browsers

Chrome, Edge, Firefox and Brave download updates automatically, but they only apply when the browser restarts. If you keep dozens of tabs open for weeks, you may be running an old version. Look for an update notice near the menu button, or open the browser's About page (in Chrome, Settings > About Chrome). It checks and prompts you to relaunch. Your tabs come back. Safari updates with macOS.

Your router sits between every device in your home and the internet, and router flaws are a favorite target because so few people ever update them.

• Router you bought yourself: sign in to its app or admin page and look for a firmware or automatic update setting. Mesh systems from the big brands usually update themselves if you leave the option on. Our home Wi-Fi guide covers the rest of the router settings.
• Router or gateway from your internet provider: most providers push firmware updates remotely. If the box is many years old, ask whether it is still supported and request a replacement if not.
• Smart TVs and streaming boxes: look in the settings menu under Support, System or About for a software update option, and turn on automatic updates.
• Cameras, doorbells, speakers, plugs: updates usually come through the maker's app. Check that auto-update is on for each one. See smart home device security.
• Printers and network storage drives: often forgotten for years. Check the maker's app or web page for firmware.

Every device eventually reaches end of support, after which newly found flaws stay open forever. It may keep working perfectly; it just gets less safe each month.

For Windows 10 machines that cannot run Windows 11, the safest options are replacement or switching to a supported operating system such as ChromeOS Flex or a mainstream Linux distribution, if you are comfortable doing that. Microsoft's Windows 10 end of support page lists the current choices.

• Never install an update from a pop-up on a website. Real updates come from your device's settings, the app store or the app's own menu. A web page that says your browser or player is out of date is a common way to deliver malware; see our guide to Mac threats.
• Back up first for big upgrades. A new version of iOS, Android, macOS or Windows rarely goes wrong, but a backup costs nothing. Routine security patches do not need this ceremony.
• Do not wait weeks "to let others find the bugs." For major feature upgrades a short wait is reasonable. For security updates, especially ones fixing exploited flaws, the risk runs the other way.
• Delete apps you no longer use. An abandoned app does not get updates, and every app is a little more attack surface.

Updates are also the first step if you suspect a problem; see how to tell if your phone is hacked. And they matter more than any paid security product: our guide on whether free antivirus is enough explains why.