Cyber security threats: unpatched and/or outdated software.

The idea

Unpatched software is software that has not received the updates, often called patches, that its developer has released to fix known faults. Outdated software is software left on an old version after newer, more secure versions exist. Both create a cyber security threat because the weaknesses they leave open are publicly known, so an attacker can look up the flaw and target it deliberately. A patch closes a specific vulnerability; skipping it keeps that vulnerability live. For example, if a browser update fixes a flaw that lets a malicious page run code, a machine still running the old version remains exposed until the update is applied. The threat is not the update itself but the gap between the known fix and the software actually in use. Learners should be able to recognise this as a threat in a scenario and distinguish it from other threats such as weak passwords, phishing or malware.

What earns the marks

• Identifies unpatched software as software that has not had available security updates applied.
• Identifies outdated software as software still running an old version when a newer version exists.
• Explains that known vulnerabilities remain open and can be exploited by attackers.
• Distinguishes this threat from other threats such as phishing, weak passwords or malware.
• Applies the idea to a scenario, for example a machine left on an old browser version after a fix is released.

Common mistakes and how to put them right

• Thinking a patch is the same as antivirus software.

  Put it right: A patch is an update that fixes a specific flaw in software, while antivirus is separate protective software.

• Assuming outdated software is harmless if it still works.

  Put it right: It can still function while carrying known, exploitable vulnerabilities.

• Confusing this threat with malware infection.

  Put it right: Unpatched software is a weakness that malware or an attacker may exploit, not the malware itself.

Exam tips

• Read the scenario and ask whether a fix already exists but has not been applied.
• Use the words known vulnerability and exploit to show why the risk is real.
• If asked to identify a threat, name unpatched or outdated software rather than describing a general 'computer problem'.