Updates patch known security vulnerabilities and should be installed promptly.
Most successful attacks exploit known vulnerabilities — security flaws that have already been publicly disclosed and for which a patch exists. The challenge for attackers is not finding new vulnerabilities; it is finding systems where the known vulnerability has not yet been patched.
The attack timeline after a patch is released is fast. Security researchers publish the technical details of patched vulnerabilities. Attackers read these publications, build exploits targeting the now-documented flaw, and scan the internet for unpatched systems. The window between patch release and mass exploitation is often measured in days.
Every surface that runs software needs updating: operating system (Windows, macOS, iOS, Android), browser, applications, browser extensions, and importantly — the router and any smart home devices, which often go years without firmware updates. Each unpatched device is a potential entry point.
Enable automatic updates wherever possible. For operating systems and browsers this is usually a straightforward setting. For other applications, check periodically. For routers, log in to the admin panel every few months and check for firmware updates from the manufacturer.