Updates and maintenance
Why Remind me later is the biggest risk on your computer

What does up to date actually mean?

An update has three states and only one of them protects you. No update available, and the machine is genuinely patched. Update detected or downloaded but not installed. Update installed, but only taking effect after a restart.

The last two states carry exactly the same risk: the known vulnerability stays open until the machine restarts. That is not theoretical. Unpatched machines are the most common ransomware entry point, because when a vendor publishes a fix it also publishes, indirectly, a description of what was broken. Attackers read the same document. The window between the day a patch ships and the day it goes live on your machine is their opportunity.

The XIT agent counts, every 15 minutes, every update the operating system reports as not installed. It does not stop at software: it searches driver updates too, and tags each pending update by kind — security, driver, feature or general. That classification matters later, when someone has to decide what goes in today and what can wait for a quieter afternoon.

Why is one pending update already a warning?

The threshold is not set at some vague notion of too many. One pending update raises a warning. Ten or more is marked critical. The logic is simple: there is no such thing as a security patch that is only slightly pending. Either the fix is live on the machine or it is not, and while it is not, the hole is open.

The threshold of 10 tells a different story. A machine with ten pending updates did not miss one patch. It has not been restarted, or someone has been dismissing the same prompt for weeks, or the update process is failing quietly. That is a pattern rather than an incident, which is why it is treated as a fault and not a reminder.

In the monthly report this appears in plain language under the maintenance and updates section: either no pending updates, or the number pending with a note that they include security fixes. No tool names, no raw log output. The same principle runs through all of continuous monitoring: a number, what it means, and a recommendation.

What happens on a machine that has not been patched in 60 days?

Alongside the pending count, XIT measures the age of the last installed patch — days since any Windows update was actually installed. More than 60 days raises its own separate warning. That distinction matters more than it looks: a machine can report zero pending updates simply because its update search has been stuck for two months.

Here XIT does something that is not the industry norm: it does not invent a list of vulnerabilities. No agent genuinely knows which specific flaw is exposed on your machine without a complete inventory of every application and version on it. Rather than attaching impressive-looking vulnerability identifiers to a guess, XIT reports the gap that actually exists: how long the machine has gone unpatched and how many updates are waiting. A machine patched within the last month with fewer than 10 updates pending is not reported as a finding at all.

Why does the fault come back after you reinstall the software?

There is a category of fault that behaves confusingly. An application keeps crashing, you uninstall and reinstall it, it behaves for a day, then it crashes again. That happens when the problem was never in the application at all, but in the operating-system files it depends on. A system file damaged by an unclean shutdown, a disk that filled up mid-update or failing hardware stays damaged after a reinstall, because nothing in that reinstall touched it.

That is why these checks exist as actions a technician can run remotely, and why they appear in the customer report under names a non-technical reader can follow:

• System file integrity — scans the Windows system files and repairs damaged ones. It takes a few minutes and the result comes back to the technician.
• Installation file repair — restores the system image. This is the step used when the integrity scan found damage it could not repair, because the store of clean files it copies repairs from is itself damaged. That ordering is why this fixes cases where reinstalling the application changed nothing.
• System volume verification — the Mac equivalent, a read-only integrity check of the operating-system volume.
• Background services — which services are set to start automatically but are not running, which are stuck part-way through starting or stopping, and how they depend on each other. A stuck service is a common reason an update fails with the same error over and over.
• System event log — system errors from the last 24 hours. Fifty or more in a day raises a warning on its own, before anything has visibly broken.

These are also the first step in crash analysis, because a corrupted system file and a recurring blue screen are very often the same story told twice.

Drivers in error, and the fault that appeared right after an update

A driver is the translation layer between the operating system and a piece of hardware. When one is in an error state, an entire component stops working — the printer disappears, the network card will not connect, the microphone is silent on the call. Users almost never describe this as a driver problem. They say the computer started behaving strangely.

The agent pulls the list of devices the operating system itself has flagged as faulty, with the component name and its class, and every one raises a warning. This is one of the clearest cases where an automated check saves an hour of guessing, because it names the component instead of the symptom.

The other side of this is just as important and less comfortable to say: a driver update is itself a common cause of a brand-new fault. A new printer or graphics driver can break something that worked yesterday. That is exactly why updates are classified by category and can be installed as security only, drivers only, or everything. For a small business that separation is worth real money: security patches go in immediately, and the printer driver goes in separately, when somebody is around to check that the printer still prints.

Windows licensing and certificates about to expire

Two quiet things that can cost a full working day with no advance warning.

Licensing state. The agent reads the operating system's own licence status and distinguishes between activated, unlicensed, grace period and notification state. Anything other than activated raises a warning, because that is where the restrictions and the full-screen prompts begin. On second-hand machines and machines that have had a hardware upgrade this is far more common than people expect, and it tends to surface on exactly the day something is due.

Digital certificates. The agent scans the machine's certificate store and reports anything expiring within 30 days, including how many days are left. Thirty days or fewer raises a warning; seven days or fewer is critical; and if a certificate has already expired, the alert says how many days ago. Certificates get that attention because an expired certificate never announces itself. A service simply stops working, a site starts showing visitors a security warning, and nobody thinks to look there first. Thirty days of notice is enough to renew without a crisis. The rest of the protective checks are covered on the security check page.

What happens on a machine that has not restarted in a month?

The agent reports continuous uptime. Past 30 days of uninterrupted running, XIT raises a finding stating plainly that a restart would apply the pending updates. On laptops this happens more often than people realise, because closing the lid is not shutting down. The machine sleeps and resumes exactly where it was, including the same updates that have been waiting for a month.

Two things are true on a machine like that. Installed updates have not taken effect, and memory is never returned — software that leaks memory keeps claiming more of it the longer it runs, and XIT measures that upward trend across 60 days of snapshot history and flags it as a suspected memory leak. A restart is the cheap, immediate fix for both.

The opposite is measured too: three or more restarts inside a single week is flagged as a suspected stability or hardware problem. Both ends of the range are watched — too many restarts and too few.

Restarts are recommended and scheduled, never forced

This is a deliberate product decision rather than a technical limitation, and it is worth stating flatly: XIT will not restart your computer remotely without you choosing to. When an update is installed and waiting on a restart, a message appears on the machine saying the updates are installed and a restart is needed to complete them. It has two buttons: restart now, and remind me later. The restart only happens if the person at the keyboard presses the button.

You might reasonably ask why a page about the danger of postponing keeps a postpone button at all. Because the alternative is worse. A management tool that reboots a machine in the middle of a video call, an unsaved edit or a filing deadline becomes a tool people work around, and a system people work around protects nobody. So the approach runs the other way: state what is at stake, agree a time, and keep reminding. The prompt stops once the machine has actually restarted, and there is a minimum interval between reminders.

What does happen behind the scenes is that nothing gets forgotten. As long as updates are pending, they keep appearing in the alerts and in the monthly report. Remind me later postpones the restart, not the problem.

A maintenance routine: what, how often, and what it prevents

Preventive maintenance sounds like an IT department's phrase. In practice it is a short list, each item preventing one specific failure:

Updates fail when the disk is full. Below 20% free space is a warning and below 10% is critical, and that is exactly the range where updates install themselves halfway and fail silently. If an update has failed twice in a row, check free disk space before anything else — the detail is on the hardware check page.

If you would rather someone else carried this, that is what the $10/month per computer package buys: the agent counts, measures and alerts, and a human technician decides what is urgent and agrees the restart window with you.

FAQ

Read next

• Security check — what else is checked beyond patching: antivirus, firewall, encryption and RDP
• Crash analysis — when a corrupted system file turns into a recurring blue screen
• Continuous monitoring — what a 15-minute report contains and what 60 days of history make possible
• Pricing — what the $5 and $10 per computer packages include