No internet, by design
- Plant networks are walled off for good reason
- Updates arrive on USB sticks, if at all
- Nobody's quite sure what's installed where
Now in early access · Try every feature free for 7 days
Keep your plant patched. Even when it's offline.
Update Sentinel keeps Windows, Linux and approved third-party apps up to date, on your schedule, whether or not the machines can reach the internet.
- 7-day free trial
- No sales call needed
- Runs on hardware you already have
Patches the operating systems your sites already run
WindowsWindows ServerUbuntuDebianRed Hat Enterprise LinuxSUSERocky LinuxAlmaLinux
The problem
Patching the plant floor shouldn't feel like a gamble.
The machines that run your operation are often the hardest ones to keep up to date.
Downtime is expensive
- An hour offline can cost an auto plant up to $2.3M
- So patches get pushed off for "the next shutdown"
- And the gap keeps growing
WSUS is winding down
- Microsoft stopped new WSUS development in 2024
- Its cloud replacements expect internet-connected PCs
- Plants need a plan B that works offline
Why it matters now
Attackers aren't waiting for your next shutdown.
1,721Known exploited vulnerabilities on CISA's watch listCISA KEV catalog, Sept. 2026
119Ransomware groups that hit industrial companies in 2025, up from 80Dragos OT Year in Review 2026
43daysMedian time to patch, up from 32 the year beforeVerizon DBIR 2026
2 in 3Industrial ransomware victims that were manufacturersDragos OT Year in Review 2026
The list of actively exploited flaws keeps growing
Vulnerabilities in CISA's Known Exploited catalog, cumulative
| 2021 | 311 |
|---|---|
| 2022 | 866 |
| 2023 | 1,053 |
| 2024 | 1,239 |
| 2025 | 1,484 |
| 2026 | 1,721 |
2026 is year to dateSource: CISA
Microsoft tops the list by a mile
Entries in CISA's Known Exploited catalog, by vendor
| Microsoft | 388 |
|---|---|
| Cisco | 99 |
| Apple | 94 |
| Adobe | 81 |
| 75 | |
| Oracle | 46 |
If your plant runs Windows, patching it is job one.Source: CISA, Sept. 2026
The fix
Patching that fits how plants run.
Built for sites where uptime comes first and the internet is optional.
Works offline
A small relay at your site holds approved updates, so machines keep patching when the outside link is down.
USB for sealed sites
Never connected at all? Carry a signed update bundle in on a USB drive. Every file is checked before use.
Common apps, from a vetted list
Keep browsers, PDF readers and runtimes current from our curated catalog. The list is closed for security, and we add apps on request.
On your schedule
Line up each rollout with your maintenance windows. Pause or resume anytime.
Small group first
Updates hit a pilot group first. The next group only starts once the last one passes.
Proof for auditors
Changes land in a tamper-evident log you can verify with one click.
Try it yourself
Cut the internet. Patching keeps going.
Flip the switch below to see what happens when your plant loses its outside connection.
Plans, approvals and results sync with the cloud.
No network path at all? Export a signed transfer bundle, carry it in on a USB drive and import it at the site. The bundle is checked against your organization and every file is verified before anything installs. See how it works.
Safe rollouts
Start with a few machines. Then roll out to the rest.
- Start with a pilot group of a few machines
- Set a pass mark, like 95% successful installs
- The next group waits until the last one clears it
- Pause, resume or stop a rollout from one screen
Example rollout4 rings
1 · Pilot100%
2 · Line A98%
3 · Plant 164%
4 · Plant 2Waits
Pass mark: 95%. Plant 2 starts only after Plant 1 clears it.
Vulnerability intelligence
Know which exploited flaws are still open.
- CVE IDs and CVSS scores for every missing update
- CISA's known-exploited list flagged, with its due dates
- A status for every machine: open, scheduled, in progress, remediated
How we stack up
Does it work on the plant floor?
Most patch tools were built for office laptops with fast internet.
What you need | Update Sentinel | Cloud patch toolsAutomox, Action1 and similar | WSUSMicrosoft, on-premises |
|---|---|---|---|
| Keeps patching when the internet is down | |||
| Managed from the cloud, just a light relay on-site | You run the server | ||
| Staged rollouts with automatic pass/fail gates | |||
| Windows and Linux in one place | |||
| Approved third-party apps, not just OS updates | Microsoft only | ||
| Sealed sites with no network path, via signed USB transfer | Manual export and import | ||
| Tamper-evident audit trail | Activity logs | ||
| Still getting new features | Deprecated 2024 |
Industries
Made for the places that keep the lights on.
Sources. CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (cisa.gov). Dragos 2026 OT/ICS Cybersecurity Year in Review (dragos.com). Verizon 2026 Data Breach Investigations Report (verizon.com). Siemens, The True Cost of Downtime 2024 (summary). Microsoft, Windows Server deprecated features (learn.microsoft.com).
Your next Patch Tuesday could be the easy one.
Set up a relay, add a few machines, and watch your first rollout finish on schedule.
7-day free trial · No sales call needed