Right access for each person
Ready-made roles for admins, operators, package curators, auditors and view-only users. Build your own too.
Product
Patch every machine on the plant floor from one place.
One place to see your machines, pick your updates, schedule the rollout and prove it's done.
See everything
Know what's on every machine.
- Hardware, software and patch status for each machine
- Missing updates found offline, using Microsoft's own signed catalog
- Roll-ups by site so you know which plant needs attention
You're in control
Nothing installs until you say so.
- New updates wait for review, they never just show up
- Approve or reject each one in a click
- Linux package sets include every dependency they need
- Add your own packages and scripts, signed before they ship
Safe rollouts
Go in stages. Stop if something's off.
- Split machines into rings, from a small pilot to the whole site
- Each ring has a pass mark, like 95% success
- The next ring waits until the last one clears it
- Pause or resume anytime, with a full history of each step
September updates · Plant 1In progress
Ring 1 · Pilot100%
Ring 2 · Line A97%
Ring 3 · Lines B–D41%
Ring 4 · ServersWaits
Each ring needs 95% success before the next one starts.
Your schedule
Patch when the line can spare it.
- Weekly or one-time maintenance windows, in each site's time zone
- Schedule each rollout to start and finish inside a window
- Set your own targets, like "critical fixes within 14 days"
Maintenance windowsCentral Time
Plant 2's Saturday window is a one-time planned shutdown.
Offline-ready
No internet at the site? Patching still runs.
- A relay at each site keeps a local copy of approved updates
- Download once, install many times, easy on thin links
- Results queue up and sync when the connection returns
- Chain relays together to reach networks nested behind other networks
- Never connected? Move signed update bundles in on a USB drive
Relay cached 38 approved updatesApp catalog
Keep approved third-party apps current too.
- A vetted catalog of common apps: browsers, PDF readers, runtimes
- Pinned versions and SHA-256 checks on every installer
- Closed for security: only catalog apps can be deployed, never arbitrary installers
- Need another app? Ask us and we'll review it for the catalog
- Same approvals, rings and windows as Windows and Linux updates
App catalogExample
Web browser
Update installed · pinned versionSHA-256
Update installed · pinned versionSHA-256
PDF reader
Update installed · pinned versionSHA-256
Update installed · pinned versionSHA-256
Archive tool
Install or update · pinned versionSHA-256
Install or update · pinned versionSHA-256
.NET desktop runtime
Update installed · pinned versionSHA-256
Update installed · pinned versionSHA-256
Always know where you stand
See where every site stands.
- Installed, missing, pending and failed counts for every site
- Trends over time so you can show progress
- Flags anything past your target date
Machines fully patched
Example site, first 8 weeks on Update Sentinel
| Wk 1 | 61% |
|---|---|
| Wk 2 | 68% |
| Wk 3 | 74% |
| Wk 4 | 79% |
| Wk 5 | 85% |
| Wk 6 | 90% |
| Wk 7 | 94% |
| Wk 8 | 97% |
Illustrative example, not customer data
Vulnerability intelligence
See the risk behind every missing update.
- CVE IDs with CVSS v3.1 and v4.0 scores for the updates each machine is missing
- CISA KEV flag with its due date and known ransomware use
- Remediation status per machine: open, scheduled, in progress, remediated, failed, risk accepted or not applicable
- Due dates from the KEV deadline, or your own target by severity
- Sources: CISA KEV, Microsoft security updates and NIST's National Vulnerability Database
Audit-ready
A record nobody can quietly edit.
- Each entry is chained to the one before it, so changes can't hide
- Check the whole chain with one click
- Send events to your security tools over syslog or a webhook
Also included
Also included in every plan.
Signed scripts
Run your own PowerShell or bash fixes. They only run if the signature checks out.
Copy-paste installs
Download installers for Windows and Linux, with ready-made silent install commands.
Storage you control
Set how much disk each relay may use. Old content is cleared out automatically.
Backup relays
Pair two relays at a critical site so one can take over if the other goes down.
Many sites, one view
Manage every plant from one console, with each site's relay doing the local work.
Your next Patch Tuesday could be the easy one.
Set up a relay, add a few machines, and watch your first rollout finish on schedule.
7-day free trial · No sales call needed