You’ve got three proposals from IT companies on your desk. Each one promises “proactive monitoring” and “patch management”, often in the same words. What you can’t tell from the page is whether anyone will install the updates on your laptops, or what happens when one fails.
I’d ask each provider for a sample of their monthly patch report, with the client’s name taken out. It lists which devices updated, which failed and what the provider did about the failures. If they can’t produce one, ask why.
Nearly every managed IT support service includes proactive monitoring and patching. They differ in five places: whether they patch apps such as Google Chrome and Zoom as well as Windows, whether critical fixes go in within 14 days, whether a failed update raises a ticket, whether a person watches security alerts out of hours, and whether anyone outside the provider checks the work. If you’re comparing outsourced IT support proposals line by line, our guide to comparing IT support quotes covers the rest of the service.
What do monitoring and patching mean day to day?
Monitoring means a small program on each laptop, desktop and server reports back to your managed service provider. It watches for a disk filling up, a drive starting to fail, a backup that didn’t run or a service that has stopped. When the office manager’s laptop is nearly full, an engineer sees the warning and clears space before Microsoft Outlook stops saving email.
Patching means installing the updates that Microsoft, Google, Adobe and other software makers release, most of them to fix security holes. A good provider schedules them so they don’t interrupt the working day, then checks that each one installed.
Together, they’re what make a managed IT service proactive. Traditional IT support is often reactive: you ring the helpdesk when something breaks, and someone fixes it. Proactive support finds many problems before anyone in the office notices them, so you get less downtime and fewer lost mornings.
Two terms you’ll see on proposals
RMM
Remote monitoring and management: the software your provider installs on each device to watch it and install updates.
SOC
Security Operations Centre: a team of analysts who watch security alerts around the clock and act on them.
Why patching matters for a business your size
When a software maker publishes a security fix, the weakness it fixes becomes public too. Out-of-date apps “could include bugs that a criminal could exploit to hack your device”, as the NCSC’s guide for small organisations puts it. Small businesses (10 to 49 staff) run the same laptops, browsers and cloud services, such as Microsoft 365, as large ones. If you don’t have an in-house IT person, nobody checks they’re up to date unless your provider does.
The NCSC’s Cyber Essentials requirements say high-risk and critical updates for operating systems, router and firewall firmware, and apps must go in within 14 days of release. Any longer, it says, “would constitute a serious security risk”. Since 27 April 2026, missing that 14-day window fails the whole Cyber Essentials assessment. We explained the change in our post on Cyber Essentials vulnerability management.
Only a third of UK businesses (34%) have a policy to install security updates within 14 days, according to the government’s Cyber Security Breaches Survey 2025/2026. Among medium businesses (50 to 249 staff), the figure is 56%.
Older laptops are a separate problem. Microsoft ended support for Windows 10 on 14 October 2025. Unless your business pays Microsoft for Extended Security Updates, a Windows 10 laptop gets no more security fixes, however good your provider’s patching is.
What each line on a proposal should cover
Proposals for managed services often put monitoring and patching on one line. I’d split it into the parts below and ask about each one.
| Line on the proposal | What it should cover | What to ask |
|---|---|---|
| Operating system updates | Windows and macOS updates on every laptop, desktop and server | How quickly do critical updates go in? |
| Third-party apps | Google Chrome, Adobe Acrobat Reader, Zoom and the other everyday apps your team uses | Which apps do you patch, and how do you decide? |
| Firmware updates | The built-in software on routers, switches and servers | Who updates our router, and how often? |
| Device health monitoring | Disk space, drive health, data backup and services | What happens when a backup fails? |
| Security monitoring | A person who sees and acts on security alerts outside business hours, including weekends | Who responds at 2am on a Sunday? |
| Vulnerability scanning | Regular scans for weaknesses that patching misses, such as settings left open | Is scanning included, or a separate service? |
| Patch reporting | A monthly report showing which devices updated, which failed and why | Can I see a sample report? |
How to check a provider actually does it
These eight checks work on a provider you’re considering and on the one you have now.
- Ask for a patch report. A good one lists each device, the updates it installed, any that failed and why. Without a report, you can’t see whether updates happen at all.
- Ask how quickly critical updates go in. Look for 14 days or less for high-risk and critical updates, written into the service level agreement or contract. “As soon as possible” gives you nothing to hold them to.
- Ask which apps they patch beyond Windows and macOS, and how they decide. Your team’s web browser and PDF reader need updates as much as Windows does. A good answer points to a published list of apps that grows as app makers add ways to update automatically.
- Ask what happens when an update fails. Updates fail when a laptop has been switched off for a week, a disk is full or an app was left open. Look for a failed update raising a ticket automatically, so an engineer fixes it before next month’s report.
- Ask which alerts a person sees at 2am, and which wait for the morning. Security alerts need someone on shift around the clock. A disk filling up can wait for the next working day. Get the split in writing so you know what you’re paying for.
- Ask whether every device is in the monthly fee. That means every laptop, desktop and server, including laptops people take home. If a device isn’t monitored, nobody will notice when its updates stop. Our guide to IT support costs explains what a predictable monthly fee should cover.
- Ask whether they test updates before the whole office gets them. Now and then an update causes trouble. In March 2021, a Windows 10 security update made some computers crash with a blue screen when people printed to certain printers, and Microsoft released a fix six days later. A provider who sends updates to a few machines first can hold back a bad one before it reaches everyone.
- Ask who checks their work. Checks 1 to 7 rely on what the provider tells you. I’d choose one that an independent body monitors, such as Assurix, which connects to the provider’s own systems and checks them every day. Without that, you’re taking their word for it. Cyber Essentials Plus helps too, but it’s an assessment at one point in the year.
Signs your updates aren’t happening
- “Restart to update” messages sit on screens for weeks.
- Some laptops still run Windows 10.
- Your provider can’t tell you how many devices you have.
- You only hear from your provider when you ring them.
Any one of these is worth raising with your provider this month.
What we include
This is how our managed IT support handles monitoring and patching.
| What | How we do it |
|---|---|
| Patching | Scheduled operating system and third-party app updates on every managed device, in the monthly fee. A failed update raises a ticket for an engineer. |
| Third-party apps | Mainstream business apps such as Google Chrome, Adobe Acrobat Reader and Zoom. The list grows over time; an app is included when its maker provides a way to update it automatically. |
| 14-day target | We aim to install high-risk and critical updates within 14 days for every client, whether or not you hold Cyber Essentials. |
| Test group first | Updates go to a small test group of machines, then to everyone, so a faulty update doesn’t stop the whole office. |
| Device health monitoring | Disk space, drive health, backups and services on every managed device. An engineer picks up device health alerts the next working day. |
| 24/7 security monitoring | A 24/7 Security Operations Centre comes with every managed device. A global team of security analysts reviews alerts around the clock and contains threats, and our Brighton team picks up from 08:00 as your named contact. |
| Vulnerability scanning | A separate service that finds weaknesses routine patching misses. |
| Patch reporting | Every client gets a monthly patch report. |
| Independent checks | Assurix connects to our service desk, monitoring, Microsoft 365 management and backups, and checks 59 security and operational controls every day, patching among them. If a standard slips, we have 30 days to put it right or we lose the trustmark. You can see our record on the public register. |
| Tickets | An engineer reviews every ticket within 15 minutes, Monday to Friday, 08:00 to 18:00. |
How we help
We’re based in Brighton and provide managed IT support to over 90 businesses across Sussex, Surrey, Kent and London. We were the first IT provider in Sussex and the South East to earn the Assurix Trusted MSP trustmark. Our post on what Assurix checks has the detail.
Our clients give us a 99.1% ticket satisfaction rating. New clients also have our 100-day money-back guarantee: if we’re not right for you within 100 days of your service going live, we refund the service fees you’ve paid.
Frequently asked questions
Which managed IT support services include proactive monitoring and patching?
Nearly every provider of managed IT support lists both. The differences are in the detail: which apps they patch, how quickly critical updates go in, what happens when one fails, who watches alerts out of hours and whether anyone independent checks the work. Ask for a sample patch report to see how a managed IT support provider does it.
What is patch management in IT support?
It’s the job of installing software updates, mostly security fixes, on every device in your organisation, checking they worked and fixing the ones that didn’t. In a managed IT service, your provider does it for you with monitoring software on each device.
How can I check my IT provider is installing updates?
Ask for last month’s patch report. It should list each device, what was installed and what failed. On a Windows 11 laptop, you can also open Settings, then Windows Update, then Update history, to see when updates last went in.
Does Cyber Essentials require updates within 14 days?
Yes. High-risk and critical security updates for operating systems, firmware and apps must be installed within 14 days of release. Since 27 April 2026, missing this fails the assessment.
What’s the difference between patching and vulnerability management?
Patching installs the fixes that software makers release. Vulnerability management also scans your devices and network for weaknesses that patching doesn’t cover, such as settings left open or software nobody knew was installed, and tracks them until they’re fixed.
Can remote IT support update laptops at home?
Yes. Monitoring software reports over the internet, so a laptop at home gets the same updates as one in the office, as long as it’s switched on and online. Our post on secure hybrid and remote working covers the rest of the setup.
Final thought
This week, ask your provider for last month’s patch report, and ask who checks it apart from them. If they can’t answer either, you’ve learnt what you needed to know.
👉 Talk to us about monitoring and patching. We’re happy to talk it through.
