What does it cost a small office to patch its firewall within 48 hours instead of two weeks? On our illustrative numbers, about $2,700 a year. That is the price of small business patching on the fast clock, and we think every Canadian firm with a box it has to update by hand should pay it, because the slower clock in Canada’s own guidance was set before attackers got this fast.
Key points
Small business patching runs on two clocks
The Cyber Centre’s baseline advice for smaller organizations is to switch on automatic patching wherever it exists and keep a regular manual process for whatever cannot update itself. That second group gets no deadline in the baseline controls. The clock we found sits in a separate patching guide.
That guide, ITSM.10.096, sorts patches by risk. Extreme: 48 hours. High: two weeks. Medium: the next major update or three months. Its page was last modified on August 8, 2022.
Laptops and browsers patch themselves overnight. The hand-patched list is short and costly to get wrong: the firewall, the VPN appliance, the storage box, the website plugins, the accounting server nobody reboots at month end. Most face the internet, and small business patching for them runs on whatever clock your IT provider picked.
What the race looked like in 2023
Attackers moved faster than two weeks. Mandiant’s analysis of 138 vulnerabilities exploited in 2023 put the average time to exploit at five days, down from 32 in 2021 and 2022. Mandiant trims 15 outliers to get there; leave them in and the average is 47, so read five as the trimmed figure and the long tail as real.
Read the card as a bet. Waiting the full two weeks on a high-risk patch lets at least the 29% hit in the first week go by. The UK’s National Cyber Security Centre said on November 3 that AI tools are speeding up how fast flaws get found, and that internal patching and testing will have to keep pace. The same report credits defensive AI with speeding up patching too, which only helps the firms that apply the fix.
What patching within 48 hours costs an office of 22
Here is the invoice, every input labelled. Take a hypothetical Lethbridge engineering office of 22 people with an outside IT provider and six internet-facing items that will not patch themselves. Say their vendors publish one urgent fix a month between them, and each visit takes an hour and a half at $150 an hour (illustrative; use your own rate).
The $54,772 figure is Statistics Canada’s average for all businesses with 10 or more employees in 2025, and that average includes large firms, so a firm of 22 likely spends less. Even so, tripling the workload keeps fast small business patching under a sixth of a typical prevention budget. The bill grows with every hand-patched device, so retiring old ones is the cheapest saving.
The side of the ledger nobody can price
The cost of the slow clock is the part you cannot look up. Statistics Canada says 15% of small businesses were hit by a cyber incident in 2025, and 23% of all businesses that were hit named an exploited software, hardware or network weakness as a method. If small firms follow the overall mix, that is roughly 3 in 100 a year (our arithmetic; Statistics Canada does not publish it).
What an incident costs a small firm is harder. In the agency’s table of average recovery costs, every 2025 figure for small enterprises is withheld, either as too unreliable to publish or for confidentiality. So the ledger has one known line, a few thousand dollars, and one blank. When the known line is that small, we would pay it.
The same survey has an AI number: 11% of businesses used AI-based cyber security tools in 2025, against 46% of large ones. Attackers’ tools are speeding up while most small defenders still work by hand. We covered the legal side of that pressure in our read of Canada’s critical cyber law and the UK’s AI ransomware warning.
Where a faster clock buys nothing
The sceptic has two strong numbers. First, 97 of Mandiant’s 138 exploited bugs in 2023 were zero-days, hit before any fix existed. No patch clock touches those, which is roughly 70% of the list. Second, the Cyber Centre itself warns that a patch applied without testing can break systems in ways that are costly to fix.
Both are fair, and neither changes the call for the short list. Zero-days argue for segmentation and backups on top of fast patching. In our view, testing risk is real for the accounting server and smaller for a firewall vendor’s security release. Our website patch plan and fix list for online stores show how to stage a fix on one machine first. A leaked key needs a different order, covered in our guide to rotating API keys after a host breach.
Count the devices that cannot update themselves, multiply by your provider’s rate and the vendors’ fix rate, and set the total against the blank line. Bring that count to your next IT renewal, and keep the spare minutes for the money reads we file under AI for business.
FAQ
How fast should a small business apply security patches in Canada?
The Canadian Centre for Cyber Security’s patching guide, ITSM.10.096, recommends 48 hours for extreme-risk patches, two weeks for high-risk ones and up to three months for medium risk. For small business patching on internet-facing devices that cannot update themselves, we argue for 48 hours.
Does the Cyber Centre tell small businesses to patch automatically?
Yes. Its baseline controls recommend automatic patching for all software and hardware that offer it, or a full vulnerability and patch management process. Devices that cannot update themselves need a regular manual process or replacement.
How quickly do attackers exploit a newly patched bug?
Mandiant’s analysis of 2023 found an average time to exploit of five days, or 47 with outliers left in. Of bugs that already had a patch, 12% were exploited within one day and 29% within a week.
How many Canadian small businesses are hit by cyber incidents?
Statistics Canada says 15% of businesses with 10 to 49 employees were impacted by a cyber security incident in 2025, against 16% of all businesses with 10 or more employees.
Figures checked November 5, 2026 against the Cyber Centre, Statistics Canada, Mandiant and NCSC pages linked above. The office of 22 is a labelled illustration.
