Patch Management
Patches close the door. We make sure they actually do.
Risk-prioritized patching across endpoints, servers, network devices, and third-party applications. Scheduled windows, exception handling, rollback planning, and evidence your auditors will accept.
- Windows, macOS, Linux, and firmware coverage
- Microsoft + third-party application patching
- KEV + EPSS risk-based prioritization
- Audit evidence for CMMC, HIPAA, PCI, NIS2
What's included
A patching program, not a script that hopes for the best.
Most environments don't have a patching problem — they have a coordination problem. Inventory drifts, third-party apps lag, exceptions never get reviewed, and reboot windows quietly slip. We run patching as an operational discipline with the asset reconciliation, scheduling, and evidence to back it up.
-
OS patching
Windows, macOS, and major Linux distributions across endpoints and servers.
-
Third-party apps
Browsers, runtimes, productivity suites, PDF readers, and common server agents.
-
Server & workload
Coordinated patching for application servers, databases, and hypervisors with documented dependencies.
-
Network & firmware
Firmware and software updates for managed firewalls, switches, and security appliances.
-
Maintenance windows
Per-asset-class schedules with documented blackout periods and reboot coordination.
-
Exception handling
Documented justifications, compensating controls, and review dates — not silent skips.
-
Rollback planning
Pre-deployment rings, validation checks, and a documented backout path before broad release.
-
Audit reporting
Framework-mapped evidence packs aligned to CMMC, HIPAA, PCI, NIS2, and SOC 2.
Prioritization
Patch by risk, not by Patch Tuesday.
"Critical" on a vendor bulletin doesn't mean critical for your environment. Every patch is sequenced against five real-world signals before it lands in a deployment ring.
01
CISA KEV
Is the underlying CVE on the federal known-exploited list?
02
EPSS
What is the statistical exploit probability over the next 30 days?
03
Exposure
Is the affected asset internet-facing, segmented, or fully internal?
04
Criticality
Does the system carry regulated data or run a revenue-bearing process?
05
Chain risk
Could an attacker chain this with another finding for lateral movement?
How it runs
From CVE release to evidence — five steps.
The same workflow runs every cycle. No surprise reboots, no quiet skips, no patches that "should have been deployed last month."
-
Step 01
Inventory
Reconcile patch agents against asset inventory. Surface unmanaged or drifted endpoints before the cycle starts.
-
Step 02
Triage
Score each release against KEV, EPSS, exposure, criticality, and chain risk. Assign emergency, expedited, or standard track.
-
Step 03
Stage
Deploy to a pilot ring, validate on representative workloads, and confirm rollback path before broader release.
-
Step 04
Deploy
Production rollout in defined maintenance windows with stakeholder notification and reboot orchestration.
-
Step 05
Evidence
Compliance-mapped reporting on deployment status, exception register, and dwell-time SLAs.
Business continuity
Patches that don't break Monday morning.
Pilot rings, validation checks, and documented rollback paths are part of every cycle. Production fleets only get a patch after it's been observed in a representative pilot — not because the vendor said it was stable.
- Pre-deployment rings with representative workloads
- Documented backout path per change
- Reboot orchestration aligned to your business hours
Compliance evidence
Evidence assessors and auditors accept.
Every cycle produces a deployment record, an exception register, and dwell-time metrics mapped to the framework you operate under. CMMC 2.0 / NIST 800-171 SI.L2-3.14.1 is supported as part of the same evidence pack.
- CMMC 2.0 · NIST 800-171 (flaw remediation)
- HIPAA Security Rule §164.308(a)(1)(ii)(B)
- PCI DSS 4.0 Requirement 6.3 · NIS2 Article 21
-
What does managed patch management cover?
Operating system patching for Windows, macOS, and Linux across endpoints and servers, plus third-party application patching (browsers, runtimes, productivity suites, common server agents) and firmware updates for managed network and security devices. We coordinate scheduling, deployment, validation, and reporting.
-
How do you prioritize what to patch first?
Patches are sequenced by real-world risk: CISA KEV status, EPSS exploit probability, internet exposure of the affected asset, business criticality, and chained risk. That feeds an emergency, expedited, or standard track — not a flat severity bucket.
-
How are maintenance windows handled?
Windows are agreed in advance per asset class — production servers, line-of-business workstations, executive devices, and edge infrastructure each get their own cadence. Out-of-band emergency patches follow a documented expedited-change path with stakeholder notification and a rollback plan.
-
What happens when a patch can't be applied?
Exceptions are documented with a justification, a compensating control (segmentation, virtual patching, monitoring uplift), and a review date. Exceptions are tracked in the same evidence repository as deployed patches so auditors and assessors see a complete picture.
-
Does this satisfy CMMC, HIPAA, or PCI requirements?
Patch management is a recurring control across CMMC 2.0 / NIST 800-171 (SI.L2-3.14.1 flaw remediation), HIPAA Security Rule §164.308(a)(1)(ii)(B), and PCI DSS 4.0 Requirement 6.3. We deliver deployment evidence, exception logs, and SSP-ready documentation aligned to the framework you operate under.
-
Can you co-manage with our existing IT or MSP?
Yes. Most engagements are co-managed — your IT team or MSP owns asset access and change approval, we own the patch program, prioritization, deployment automation, and reporting. We can also run patching fully outsourced when there isn't an internal team to coordinate with.
Talk to an engineer
Want patching that produces evidence, not anxiety?
Tell us what tooling you have today (Intune, WSUS, ConfigMgr, Tanium, Action1, Automox, Kandji, Jamf, or nothing yet), what frameworks apply, and where your backlog is. We'll come back with a real program.