BG Beter Geregeld ICT
Security zonder IT-afdeling · 2 min leestijd · 28 December 2025

Patch management for SMBs without MDM muscle

Patches need to go on. But how do you enforce that without Intune or Jamf? Here's the pragmatic minimum setup.

Unpatched systems are the biggest breeding ground for attacks. Large organisations handle this with an MDM. Without one, you have to rely more on policy and monitoring.

The three layers

  1. OS updates: Windows Update, macOS Software Update. Set to automatic, deferral max 2 weeks. On enterprise editions: via Windows Update for Business.
  2. Browser: Chrome, Edge, and Firefox update themselves. Enforce via Chrome Enterprise policy if that's not happening.
  3. Applications: Office, Acrobat, Teams via their native updaters. VPN clients. Password manager. This is where many SMBs fall behind.

Monitoring without MDM

  • Quarterly survey: "send a screenshot of About → version" for each critical app.
  • For devices registered in Entra ID: check via Security → Devices compliance report.
  • Chrome Enterprise policy reports versions centrally (free with Google Workspace).

Communicating the requirement

Once a quarter, hold a "patch day" — everyone runs their updates. The manager sees completion. Not a personal task, but a team moment.

Moving towards Intune?

Business Premium including Intune is €19/user/month and largely automates all of this. With > 20 employees, it starts paying for itself quickly. See Intune basics.

See also: security pillar.

Onderwerpen

#security #patch-management #updates

Volledige gids: Seguridad para pymes sin departamento de TI: ¿qué haces este trimestre?

Dit artikel is onderdeel van onze uitgebreide Security zonder IT-afdeling-gids. Lees de pillar voor het complete plaatje.

Lees de pillar →

Verwant leesmateriaal

Security zonder IT-afdeling

Security for SMBs without an IT department: what should you do this quarter?

No IT team, but still accountable. This pillar gives you a priority stack: do this first, then that, then the less urgent stuff. Each item links to a deeper guide.

2 min
Security zonder IT-afdeling

Choosing a password manager for your SMB: what really matters?

Choosing a password manager isn't a matter of taste — but it's not rocket science either. A practical guide for business owners without an IT department.

6 min
Security zonder IT-afdeling

Uptime monitoring for SMBs: don't hear about it from your customers

Your website is down and you find out from a customer. There's a better way. Here's how to set up uptime monitoring as an SMB without an IT department — without drowning in false alerts.

6 min
Security zonder IT-afdeling

MFA for every SaaS tool, not just M365: catching up the stragglers

M365 and Google make MFA easy. So do Dropbox, Slack, GitHub, and Trello. But those other SaaS tools? MFA is often missing. Here's how to close the gap.

2 min
Security zonder IT-afdeling

Security awareness training: what works and what's a waste of time

An annual 60-minute security video is a waste of time. Quarterly 10-minute targeted sessions actually work. Here's the programme that gets results.

2 min
Security zonder IT-afdeling

Vendor risk management for SMBs: a practical framework

Every SaaS subscription is a slice of risk you're outsourcing. How do you decide which of your 30 vendors actually deserve closer attention?

2 min
← Alle artikelen in "Security zonder IT-afdeling"