One Year After WannaCry: What Small Businesses Still Haven't Fixed

On May 12, 2017, the WannaCry ransomware attack began spreading across the globe at a speed that shocked even seasoned security professionals. Within 24 hours, over 230,000 Windows systems across 150 countries were encrypted. The UK's National Health Service was brought to its knees. FedEx, Telefónica, Renault, and thousands of small businesses worldwide were crippled. The total economic damage is estimated between $4 billion and $8 billion. One year later, the vulnerability that made all of it possible Microsoft's MS17-010, patched in March 2017 59 days before WannaCry began spreading remains unpatched on millions of computers worldwide. Many of them are in small businesses.

What WannaCry Actually Was and Why It Spread So Fast

WannaCry was a worm-ransomware hybrid. Traditional ransomware required a victim to click a link or open a malicious attachment. WannaCry did not. Once it entered a network, it used a leaked NSA exploit called EternalBlue to automatically infect every vulnerable Windows machine on the same network no clicks required. A single unpatched laptop connected to a corporate network could infect every computer in the building within minutes.

Why Small Businesses Were Disproportionately Affected

• No centralized patch management: Many SMBs rely on individual employees to accept Windows Update prompts and most dismiss them indefinitely.
• Legacy Windows versions: Many affected systems ran Windows XP or Windows 7, either due to budget constraints or legacy software dependencies.
• No network segmentation: When WannaCry entered a flat SMB network, there were no internal barriers it reached every device.
• No incident response plan: Most SMBs did not know what to do in the first hour of an attack.

The Patch Management Problem Is Structural, Not Behavioral

After WannaCry, everyone recommended better patch management. A year later, internet-wide scans consistently find millions of systems still exposing the MS17-010 vulnerability. The problem did not get solved because for most small businesses, patch management is not a process. There is no one whose job it is to verify every device received every critical patch within 48 hours. There is no central console showing what is current and what is behind. Without that infrastructure, telling a small business to "keep their systems patched" is meaningless.

What Centralized Patch Management Actually Looks Like

• A Remote Monitoring and Management (RMM) tool that inventories every device and tracks patch status in real time
• Automated deployment of critical patches within 24–48 hours of release
• Monthly patch compliance reports showing which devices are current and flagging any that failed to update
• A defined process for devices that miss patches remote troubleshooting or on-site intervention within a defined SLA
• Separate patching tracks for servers versus workstations

The Three Lessons WannaCry Forced IT Professionals to Relearn

1. 1Speed of patching is a security metric: The gap between patch release and patch deployment is a window of vulnerability. WannaCry had a 59-day window. Businesses that patched in the first week were safe.
2. 2Network segmentation is not just for enterprises: In every WannaCry case where damage was limited, organizations had some form of network segmentation. Flat networks turn a single infected device into a company-wide disaster.
3. 3Offline backups are non-negotiable: WannaCry encrypted everything it could reach, including network-attached storage. Only cloud backups with version history or physically disconnected media survived intact.

What to Do Right Now If You Haven't Already

• Verify MS17-010 is patched on every Windows device in your organization
• Check whether any Windows XP or Vista machines remain these received no official patch and should be isolated or retired
• Confirm SMB version 1 (SMBv1) is disabled WannaCry requires SMBv1 to propagate
• Test your backup restoration do not assume your backup works until you have actually restored from it
• If you do not have centralized patch management, it is time to talk to a managed IT provider