Updated October 2026 to our current guidance. The original reporting date is unchanged.
Your security screen says you’re protected, and for what it watches, it’s right. It doesn’t count the programs on your computer or check whether they’re current. Here’s how to see that for yourself.
Count What’s on Your Computers →See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed.
You have security software. Windows updates itself. Somebody looks after the computers. For most businesses that setup does its job most days.
Here is where the job ends. Windows Update never touches third-party software. And the security screen only watches for known bad files. So who has been checking the rest?
In this article
Hey folks! The word “vulnerability” scares people off, so let me make it plain. An open door is a way in that nobody shut.
• A program that is a version or two behind. The PDF reader. The old accounting add-on. That tool you forgot you had.
• A setting Windows leaves the wrong way, on when it should be off.
• A program Windows Update never touches, because the built-in updater only covers Windows itself.
Now look at your own security screen. It likely says “You’re protected,” with a green check. It would say the same thing with three programs out of date, because it watches for known bad files trying to get in. It doesn’t ask whether your own programs are current. Green doesn’t mean checked.
Nobody did anything wrong here. The security software does what it was built to do, and Windows Update does what it was built to do. The programs in between belong to nobody unless somebody claims them.
This summer gave us a good example of how long a flaw can hide. In June, the Commerce Department restricted access to an AI model that turned out to be very good at finding weak spots in software (Al Jazeera, June 13, 2026). In April, Anthropic’s Project Glasswing reported that its model had found thousands of serious flaws in widely used software. One, in OpenBSD, had been there for 27 years. Another, in FreeBSD, for 17 (Anthropic, April 7, 2026).
BSD is some of the most carefully reviewed code there is. If it held flaws that long, the everyday programs on an office computer have them too. Most of those flaws already have a published fix. The open question is whether the fix ever got installed.
That part doesn’t depend on anyone’s AI. It depends on knowing what is on your machines.
Seeing what is out of date is one job. Updating it is the next. Most owners skip straight to updating without looking, so the program nobody remembers stays behind. Looking comes first.
Try this. Before you run anything, guess how many programs are installed on your main computer. Write the number down.
Then run the Reveal Scan. It counts what is installed on the computer and gives you two numbers: how many programs are current and how many need updating, including the third-party software Windows Update never touches. It only reads. It doesn’t change anything on the machine.
Most people guess low. If the second number is bigger than you expected, that’s common. You don’t have to be able to do this. We’ll do it with you.
You don’t need a consultant to start, and the first one takes minutes.
Write down your guess, then run the Reveal Scan on your Windows computers: forwardtosafety.com/account/reveal-scan/signup. No credit card needed. Compare the count to your guess.
Walk your main computer and write down every program that didn’t come from Windows itself: the PDF reader, the browser add-ons, the old tools. Update each one or remove it. A program nobody uses is faster to remove than to keep current.
Ask whoever handles your IT: when a fix comes out for a program Windows Update doesn’t handle, who installs it, and how soon? A person and a time is the answer you want.
My father fell for a phishing email. I had 35+ years in cybersecurity behind me, and it still reached him. The scammers got remote access and went looking for his financial documents. My step-mother noticed something was wrong. I jumped in from across the country and stopped them before they reached his bank logins.
I have spent 35+ years in cybersecurity. FBI InfraGard trainer. Dozens of managed clients since 1991. None has had ransomware. When someone does get in, in my experience it is usually through a program nobody updated. So no lecture from me. Feeling behind on this is normal, and counting is the easy part.
Keep it. That green check watches for known bad files, and it does that well. It never asks whether your own programs are current, and that is where most of the open doors on your computer are.
If your machines are already current, the counts will say so.
The Reveal Scan counts what is installed on each Windows PC: how many programs are current and how many need updating. Read-only, no credit card needed.
Count What’s on Your Computers →The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If you run it and never speak to us again, that’s a fine outcome.
Want plain-English security news every week? Sign up for Craig’s Insider Notes at CraigPeterson.com.
Craig
Join the owners who get Craig's Insider Notes every week.