TotalHealPatchPilotPatch Management
See what is missing on every computer and roll updates out in waves — with proof afterwards.
Trial: 30 days. You sign in to the TotalHeal console with a Sttiz account and activate PatchPilot Patch Management. No card.
Unpatched operating systems and applications are the commonest way in. IT teams need to see what is missing on every computer, roll updates out in waves (test group first), respect working hours and prove afterwards that it was done.
Missing-updates reports, patch rings, maintenance windows and approvals for Windows, macOS and Linux — every install a signed, audited command.
PatchPilot Patch Management, feature by feature.
Missing-updates report
Fleet-wide and per device: OS and package updates, security updates flagged and sorted first, device counts per update, CSV export.
Patch rings
Pilot first, then broad: order, deferral of 0–90 days, target groups or devices, a security-only option.
Maintenance windows and reboot policy
Days, start time and 1–24 hour duration; reboot automatically in the window, ask the user, or never.
Automatic ring deployment
Installs are queued when the deferral has elapsed and the window is open, at most once per device per day.
Deploy now, approve, defer
Deploy selected updates with a mandatory reason, release one without waiting, or defer up to 90 days with a reason.
Native installers
Windows Update, macOS softwareupdate, and apt/dnf on Linux. Linux servers get security-only updates by default and are never rebooted by us.
Drivers and firmware
Windows Update drivers and Linux firmware updates from the device page.
Third-party apps
Updates through winget, Homebrew, apt and dnf for the apps in your organisation catalogue.
Consent and proof
End users can postpone a limited number of times (default 3). Every install goes through approval levels and the hash-chained audit; “Patch status” and “Most-missing updates” reports.
How PatchPilot Patch Management works.
PatchPilot shows what is missing on every computer, rolls updates out in rings with maintenance windows and approvals, and records every install as a signed, audited command — so patching is fast, predictable and provable.
- SeeMissing OS and application updates per device and fleet-wide, security updates first.
- PlanRings with deferral, target groups and a security-only option; maintenance windows and reboot policy.
- Roll outInstalls are queued when the deferral has passed and the window is open.
- DecideDeploy now with a reason, release early, or defer up to 90 days with a reason.
- ProvePatch status and most-missing reports, every install on the audit trail.
Platforms and deployment
Platforms
| Platform | How it is covered |
|---|---|
| Windows, macOS, Linux desktops | TotalHeal desktop agent |
| Debian/Ubuntu and RHEL-family servers | TotalHeal Linux server agent |
| iPhone, iPad, Android OS updates | Through TotalHeal DeviceSphere UEM, not this product |
Deployment
| Profile | Status |
|---|---|
| SaaS (TotalHeal cloud, India region) | Available |
| On-premises | AvailableDelivered with our team from the on-premises kit. |
| Air-gapped | AvailableDevices update from your internal sources (WSUS or local mirrors). |
Unit and tiers.
Priced per managed device per year. Counted: devices with patching switched on. List prices are not published yet — our team quotes per unit and term.
| Business | Enterprise | |
|---|---|---|
| Missing-updates report, deploy now, CSV | Included | Included |
| Rings, maintenance windows, reboot policy | Included today | Included |
| Approve / defer workflow | Included today | Included |
| Driver and firmware updates | Included today | Included |
| Price | Contact sales | Contact sales |
The commercial plan moves rings, drivers/firmware and approval workflows to Enterprise later; the final split is still open.
Government profile. Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks.
What you need
- TotalHeal desktop agent or Linux server agent enrolled to your organisation
- Devices can reach their own update sources (Windows Update or WSUS, Apple, distribution mirrors)
- A TotalHeal DeviceSphere UEM entitlement (today)
Procurement documents for PatchPilot Patch Management
The datasheet is public. The full dossier is sent on request, so we can match it to your tender.
- Datasheet. What the product does, platforms, deployment profiles, tiers and honest limits.
- Compliance matrix. Each requirement marked comply, partial or no, with an evidence reference — CERT-In directions, DPDP, ISO 27001 controls touched, accessibility of the console, data residency.
- Bill of materials. SKUs per sizing, the unit and quantity formula, customer-side components and services.
- Architecture and hardening. How the product is deployed and the hardening guidance for each component.
- SLA. Support tiers, response targets the team can meet, update cadence and end-of-life policy.
- OEM authorisation letter. A MAF template for resellers and system integrators, with product names exactly as on the SKU.
Works well with
Part of TotalHeal Endpoint Operations and TotalHeal Endpoint Defense suites and of Complete — each product is still licensed on its own.
TotalHealDeviceSphere
Unified Endpoint Management (UEM)
Enrol, configure, update and secure every laptop, phone and tablet from one console.
TotalHealVulnSight
Vulnerability Management
Know which installed software carries a known, exploited vulnerability — without a scanner appliance.
TotalHealRemoteLink
Remote Access & Support
Consented, recorded remote support for Macs and Windows PCs, and audited shells on Linux servers.
Get a quote for PatchPilot Patch Management.
Tell us how many managed devices you need and how you want to deploy. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.