In early October, security.nl reported that a Dutch company had disabled a vulnerable updater for Popcorn Time on roughly two million PCs worldwide. Popcorn Time is the well known illegal streaming service that hasn’t been maintained for years, yet the updater stayed behind on millions of computers and formed a genuine security risk. The users of those PCs didn’t step in themselves. Nor did the businesses where those PCs sit. An outside company solved the problem for them, without most owners ever knowing it was there.
That alone is remarkable. What it reveals is more remarkable still. Software can run unnoticed on a workplace device for months, sometimes years, without anyone inside the organisation knowing. Not because people are careless, but because almost no one looks at it in a structured way.
Software doesn’t disappear on its own
An employee installs something for a short term project. Someone downloads a program for personal use on a work laptop. After a staff change, old software simply stays put because nobody was tasked with cleaning it up. An updater keeps running in the background, separate from the main application, even after that application has long been removed. One forgotten installation on its own is harmless. Added up across hundreds of workplace devices at a wholesaler, a manufacturer or a logistics company, it becomes a landscape nobody fully oversees anymore.
You cannot set policy for what you don’t know about
That’s really what the Popcorn Time example comes down to. You can only decide which software belongs on a business device once you know what is actually running on it. Without that overview, security stays a matter of feeling. You assume things are fine until an outside company, an attacker or an auditor confronts you with what’s really on your systems. For businesses that want to work demonstrably towards NIS2, that overview isn’t a side issue. It’s the starting point.
Measure before you ban anything
Start with an inventory of installed applications and active background processes across every workplace device. Not just the laptops of management, but also the PCs on the shop floor, at the front desk and in the warehouse. Many business owners assume their antivirus software already covers this. Antivirus software recognises known threats using fixed detection patterns, not unwanted but harmless software that isn’t classified as malware. What you need is a separate overview of what is actually running, regardless of whether it’s labelled dangerous or not.
Policy comes first, technology follows
Once you know what’s running, you can decide what does and doesn’t belong on a business device. Put that in a short, understandable policy: which software is allowed, which isn’t, and who decides when there’s doubt. Bring employees along before you enforce anything technically. Someone who has used a particular program for years experiences a sudden block as unreasonable if nobody explained why it’s happening. A brief explanation and room for questions prevent resistance, and prevent people from finding their own workarounds, such as carrying software in on a USB stick.
One whole, not separate screens
Overview of workplace devices doesn’t belong as a standalone product next to an antivirus subscription and a firewall. It’s part of how you set up the entire workplace domain: who has which permissions, which software gets rolled out by default, how new devices are prepared, and how deviations get flagged. We prefer to look at how that domain as a whole is demonstrably in order, rather than at separate tools that each solve a small piece of the problem. That way you don’t have to wait for an outside company to stumble upon what’s been running in the background at your business all along.
A few questions we’re often asked
How do I know if this kind of outdated software is running at our business too?
You only find that out with a full inventory of every workplace device. A quick check on a handful of laptops won’t give you a reliable picture. Tools exist that map this out largely automatically, without employees noticing, leaving you with a list to assess.
Isn’t antivirus software enough to flag this kind of risk?
No, antivirus software is built to recognise known malware using fixed patterns within the software itself. An outdated updater from a legal or formerly legal service usually isn’t picked up that way, because the program itself doesn’t contain a virus. Only a separate overview of all installed software shows that such an updater is still there.
How much time does an inventory like this take?
That depends on the number of workplace devices, but with the right tooling the technical part is largely automated and often done within a few days. The real work lies in assessing the results: deciding what’s needed, what can go, and who makes that call.
What do I do about software nobody seems to use anymore, but nobody dares to remove?
First check with the relevant department whether it’s genuinely no longer needed before removing anything. Record the decision, including who made it and why, so you can refer back to it later. Then agree on a moment to check whether the software is actually missed.
Want to know what’s actually running on your workplace devices before someone else points it out to you? We help SMEs map out their workplace domain, as a first step towards policy based on facts instead of a feeling.
