One Year After WannaCry: What Small Businesses Still Haven't Fixed
WannaCry hit in May 2017 and caused billions in damage worldwide. A year later, most small businesses still haven't patched the exact vulnerability that made it possible. Here's what the aftermath taught us about SMB patch management.
On May 12, 2017, the WannaCry ransomware attack began spreading across the globe at a speed that shocked even seasoned security professionals. Within 24 hours, over 230,000 Windows systems across 150 countries were encrypted. The UK's National Health Service was brought to its knees. FedEx, Telefónica, Renault, and thousands of small businesses worldwide were crippled. The total economic damage is estimated between $4 billion and $8 billion. One year later, the vulnerability that made all of it possible — Microsoft's MS17-010, patched in March 2017 — 59 days before WannaCry began spreading — remains unpatched on millions of computers worldwide. Many of them are in small businesses.
What WannaCry Actually Was — and Why It Spread So Fast
WannaCry was a worm-ransomware hybrid. Traditional ransomware required a victim to click a link or open a malicious attachment. WannaCry did not. Once it entered a network, it used a leaked NSA exploit called EternalBlue to automatically infect every vulnerable Windows machine on the same network — no clicks required. A single unpatched laptop connected to a corporate network could infect every computer in the building within minutes.
The EternalBlue exploit used in WannaCry was developed by the NSA and stolen by a hacker group called The Shadow Brokers. Microsoft had released patch MS17-010 on March 14, 2017 — 59 days before WannaCry began spreading. Organizations running fully patched systems were completely immune. The entire global catastrophe was, in a technical sense, preventable.
Why Small Businesses Were Disproportionately Affected
Get monthly IT tips for Miami businesses
No spam · Unsubscribe anytime · Practical advice only
- No centralized patch management: Many SMBs rely on individual employees to accept Windows Update prompts — and most dismiss them indefinitely.
- Legacy Windows versions: Many affected systems ran Windows XP or Windows 7, either due to budget constraints or legacy software dependencies.
- No network segmentation: When WannaCry entered a flat SMB network, there were no internal barriers — it reached every device.
- No incident response plan: Most SMBs did not know what to do in the first hour of an attack.
The Patch Management Problem Is Structural, Not Behavioral
After WannaCry, everyone recommended better patch management. A year later, internet-wide scans consistently find millions of systems still exposing the MS17-010 vulnerability. The problem did not get solved — because for most small businesses, patch management is not a process. There is no one whose job it is to verify every device received every critical patch within 48 hours. There is no central console showing what is current and what is behind. Without that infrastructure, telling a small business to "keep their systems patched" is meaningless.
What Centralized Patch Management Actually Looks Like
- A Remote Monitoring and Management (RMM) tool that inventories every device and tracks patch status in real time
- Automated deployment of critical patches within 24–48 hours of release
- Monthly patch compliance reports showing which devices are current and flagging any that failed to update
- A defined process for devices that miss patches — remote troubleshooting or on-site intervention within a defined SLA
- Separate patching tracks for servers versus workstations
The Three Lessons WannaCry Forced IT Professionals to Relearn
- 1Speed of patching is a security metric: The gap between patch release and patch deployment is a window of vulnerability. WannaCry had a 59-day window. Businesses that patched in the first week were safe.
- 2Network segmentation is not just for enterprises: In every WannaCry case where damage was limited, organizations had some form of network segmentation. Flat networks turn a single infected device into a company-wide disaster.
- 3Offline backups are non-negotiable: WannaCry encrypted everything it could reach, including network-attached storage. Only cloud backups with version history or physically disconnected media survived intact.
What to Do Right Now If You Haven't Already
- Verify MS17-010 is patched on every Windows device in your organization
- Check whether any Windows XP or Vista machines remain — these received no official patch and should be isolated or retired
- Confirm SMB version 1 (SMBv1) is disabled — WannaCry requires SMBv1 to propagate
- Test your backup restoration — do not assume your backup works until you have actually restored from it
- If you do not have centralized patch management, it is time to talk to a managed IT provider
Pro Tip
Simple Network Solutions offers a free patch audit for Miami businesses. We scan your environment to identify unpatched critical vulnerabilities — including MS17-010 and every major CVE from the past 12 months. No obligation. Call (786) 383-2066 to schedule.
Stay ahead of Miami's IT threats & trends
Monthly insights written for South Florida business owners — covering cybersecurity alerts, cost-saving IT strategies, and Miami-specific technology advice.
About the Author
Senior Cybersecurity Specialist · 14 years experience
CISSP · CEH · CompTIA Security+ · CISM · 14 Years Experience
Marco leads cybersecurity operations at Simple Network Solutions, with 14 years of experience in network security, penetration testing, and compliance for regulated industries. He has responded to over 200 security incidents for Miami businesses and holds four active cybersecurity certifications. He regularly presents at South Florida IT security events and contributes to the FBI InfraGard Miami chapter.