Skipping Updates Can Have Serious and Irreversible Consequences
Today, cybersecurity is one of the key factors driving organizational stability, and reliably functioning information systems are an essential prerequisite for operational efficiency. Nevertheless, outdated software remains one of the most common security vulnerabilities. Although deploying updates directly mitigates the risk of known vulnerabilities being exploited, statistics show that a significant portion of cyber incidents still stem from delayed patching [1, 2, 3, 4, 5].
The software lifecycle relies on continuous adaptation—expanding functionality, strengthening security measures, and fixing bugs. Developers dedicate significant effort to identifying vulnerabilities, which are addressed through regular patches and new software releases. These patches are targeted code or configuration modifications designed to eliminate identified flaws and reduce the likelihood of unauthorized actions. Unapplied patches create opportunities to bypass security controls, access confidential data, or execute other critical operations that compromise system integrity and availability [6, 7, 8, 9, 10, 11].
Modern cyberattack dynamics are characterized by a high level of automation. Scanning and vulnerability identification tools continuously probe publicly accessible services, and newly published flaws are integrated into attack execution chains almost immediately. VulnCheck data from the first half of 2025 reveals that out of 432 analyzed vulnerabilities, as many as 32.1% were exploited within the first 24 hours of official publication, with some cases recorded even prior to public disclosure. This rate significantly exceeds the 23.6% figure established in 2024, highlighting the accelerating pace of attack automation. Cloudflare’s analysis also confirms that the publication of technical information often immediately triggers the first exploitation attempts—one of which was recorded just 22 minutes after the details were published. Such dynamics demonstrate that automated scanning tools operate much faster than most organizations can deploy patches or update defense mechanisms, making proactive readiness, swift response, and systematic patch management critically important [12, 13, 14, 15].
By 2027, the advancement of artificial intelligence technologies is projected to further accelerate vulnerability discovery and exploitation, scaling automated attacks particularly against unpatched systems. The window between vulnerability disclosure and initial exploitation is consistently shrinking, and advanced analytical tools will intensify this dynamic even further, posing risks to both critical infrastructure and supply chains [16].
In the first half of 2025, a record number of software vulnerabilities was recorded—over 21,500 new flaws, representing an 18% increase compared to the same period in 2024 [17]. This trend underscores a growing burden on systems: the rising volume of vulnerabilities directly expands the attack surface and complicates timely patch management. Survey findings further confirm this persistent issue. A 2019 study by the Ponemon Institute found that approximately 60% of data breach incidents stemmed from unapplied patches, while a 2020 Automox analysis revealed that 58% of breaches were linked to missing system updates [18, 19]. These figures indicate that despite growing security investments, patch management remains one of the weakest links.
This issue is highlighted even more clearly by a 2024 study published by the U.S. National Bureau of Economic Research (NBER), which covered the period from 2000 to 2018 and examined more than 150,000 medium and large organizations. The analysis revealed that as many as 57% of them were using server software containing known critical vulnerabilities, despite security patches being available. The study’s authors emphasize that decisions to delay patch deployment often stem not from objective risk assessment, but rather from operational constraints, complex dependencies, service continuity requirements, and technological integration risks. Consequently, complex updates are frequently postponed, leaving infrastructure vulnerable for extended periods [20].
Delays in software update deployment are driven not only by technical or organizational barriers, but also by the psychology of user decision-making. A 2020 study by P. Rajivan and co-authors [21], based on repeated decision-making tasks, analyzed how users realistically evaluate the benefits and potential costs of updates. Participants periodically faced situations where they had to choose between immediate updates—incurring one-time costs in time or convenience—and postponement, which increased the risk of maintaining a vulnerable system. This methodology made it possible to observe how behavioral strategies form under repeated decision-making, constantly balancing short-term comfort against long-term risk.
The study’s results revealed a consistent shift toward procrastination: in the initial phase, 71% of participants chose an immediate update, but in later stages this figure dropped to 31%, while the proportion of those opting to forgo updating altogether rose to 46% at one point. The authors highlighted that this behavioral shift was not driven by objective technical risk, but reflected a subjective perception of update costs—additional time expenditure, fear of operational disruption, or uncertain potential outcomes. This indicates that users often view updates not as an investment in security, but as an inconvenience, leading to the long-term adoption of an organizationally detrimental practice: systematic delay [22, 23].
The Largest and Most Significant Vulnerability of the Past Decade
One of the most prominent software vulnerabilities of the past decade was the critical flaw discovered in 2021 within the open-source logging library Log4j. This library is used across thousands of different systems—from enterprise infrastructure and cloud services to mobile applications and Internet of Things (IoT) devices. The vulnerability allowed remote code execution, enabling external actors to gain control of systems or access stored data. Due to the library’s widespread integration, the vulnerability affected billions of devices worldwide and received the maximum CVSS (Common Vulnerability Scoring System) score of 10, rightfully making it one of the most significant security incidents of recent times [24, 25].
Although the library’s developers released a fix immediately, actual risk mitigation took significantly longer. Many software vendors required months to release patched versions. At the end of 2023, Cloudflare reported that Log4j remained one of the most actively exploited vulnerabilities, even though two years had passed since its discovery. This situation underscored a fundamental issue: a prompt vulnerability patch is insufficient if organizations delay deploying updates or lack effective maintenance practices. As a result, Log4j continues to serve as an example of how even a single unpatched flaw can sustain global cyber risks [26, 27, 28].
A Missed Update Cost Nearly $700 Million
One of the most widely discussed cases illustrating the consequences of unpatched software was the 2017 Equifax incident. Due to a security vulnerability in Apache Struts, hackers gained access to the personal data of nearly 148 million consumers, including names, addresses, dates of birth, Social Security numbers, and other sensitive identifiers. The vulnerability enabled remote server command execution, allowing attackers to compromise the company’s infrastructure [29].
Crucially, Apache had released a patch as early as March 2017, but Equifax failed to apply it in a timely manner. The flaw remained unpatched until late July, with remedial action initiated only after unusual network activity was detected. Investigations into the incident revealed that the failure to patch stemmed from process fragmentation, unclear boundaries of responsibility, and ineffective infrastructure inventory management. The estimated financial impact—encompassing legal proceedings, fines, compensation, and technical remediation—approached nearly $700 million [30]. This case has become one of the most frequently cited examples demonstrating how costly a single delayed patch can be.
Examples of Data Leaks Can Also Be Found in Lithuania
Cyber threats associated with unpatched software are equally relevant at the national level. On January 7, 2024, the database of „Aiva sistema” was leaked, containing contact details of approximately 260,000 users, including full names, phone numbers, and email addresses. According to experts, the breach was likely executed by exploiting an unpatched software vulnerability that granted access to the database [31].
In March 2023, the State Data Protection Inspectorate (VDAI) imposed a €6,600 fine on a public sector institution for GDPR violations. The investigation revealed that the organization was using an outdated, unpatched content management system (CMS), allowed access to the admin dashboard from external networks without two-factor authentication, and attackers exploited these vulnerabilities to exfiltrate and publish a database of 13,500 individuals on dark web platforms [32]. These examples demonstrate that outdated infrastructure poses a threat not only to businesses, but also to the public sector and individual privacy.
Updates Are a Necessity, Not an Option
Cybersecurity practice clearly demonstrates that system updating is not an optional add-on, but an essential component of infrastructure hygiene. A key challenge is that organizations often still view updates as a disruption to routine operations rather than as a strategic risk mitigation process directly linked to service reliability and business continuity.
Practical experience in e-commerce maintenance indicates that a significant proportion of online stores continue to run on software that is 2 to 5 years out of date. This situation typically originates during the initial website development phase when long-term maintenance is neglected: no budget is allocated for ongoing support, version migrations are unplanned, and the platform architecture makes updates technically complex or virtually impossible without extensive re-engineering. Faced with critical security vulnerabilities under these conditions, businesses often find it more cost-effective to build a new e-commerce website from scratch rather than attempt to overhaul an obsolete system.
This trend is corroborated by data from National Cyber Security Centre (NKSC) reports. Analyzing „.lt” domain websites that utilize content management systems, the NKSC has recorded a consistently high proportion of vulnerable websites over several years. In 2018, 52% of such websites were assessed as vulnerable due to unpatched systems and components. In 2019, this share rose to 63%, reached 56% in 2020, and was 50% in 2021. Furthermore, in 2019, 8% of websites were operating on end-of-life platforms no longer supported by developers and receiving no security patches; such websites accounted for 6.5% in 2020 and 10% in 2021 [33, 34, 35, 36]. These figures demonstrate that inadequate maintenance and lack of updates remain primary drivers of website vulnerability within the Lithuanian web space.