Patching in waves, inside working rules, with proof afterwards

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

PatchPilot shows what is missing on every computer, rolls updates out in rings with maintenance windows and approvals, and records every install as a signed, audited command — so patching is fast, predictable and provable.

2The challenge

Unpatched operating systems and applications are the commonest way in. IT teams need to see what is missing on every computer, roll updates out in waves (test group first), respect working hours and prove afterwards that it was done.

The TotalHeal approach. Missing-updates reports, patch rings, maintenance windows and approvals for Windows, macOS and Linux — every install a signed, audited command.

3Architecture

4How it works

1. SeeMissing OS and application updates per device and fleet-wide, security updates first.
2. PlanRings with deferral, target groups and a security-only option; maintenance windows and reboot policy.
3. Roll outInstalls are queued when the deferral has passed and the window is open.
4. DecideDeploy now with a reason, release early, or defer up to 90 days with a reason.
5. ProvePatch status and most-missing reports, every install on the audit trail.

5Capabilities in detail

• Missing-updates reportFleet-wide and per device: OS and package updates, security updates flagged and sorted first, device counts per update, CSV export.
• Patch ringsPilot first, then broad: order, deferral of 0–90 days, target groups or devices, a security-only option.
• Maintenance windows and reboot policyDays, start time and 1–24 hour duration; reboot automatically in the window, ask the user, or never.
• Automatic ring deploymentInstalls are queued when the deferral has elapsed and the window is open, at most once per device per day.
• Deploy now, approve, deferDeploy selected updates with a mandatory reason, release one without waiting, or defer up to 90 days with a reason.
• Native installersWindows Update, macOS softwareupdate, and apt/dnf on Linux. Linux servers get security-only updates by default and are never rebooted by us.
• Drivers and firmwareWindows Update drivers and Linux firmware updates from the device page.
• Third-party appsUpdates through winget, Homebrew, apt and dnf for the apps in your organisation catalogue.
• Consent and proofEnd users can postpone a limited number of times (default 3). Every install goes through approval levels and the hash-chained audit; “Patch status” and “Most-missing updates” reports.

6Security and data handling

• Native installers onlyUpdates come from Windows Update, Apple and your distribution or package managers — never repackaged.
• Servers are not rebootedLinux servers get security-only updates by default and are never rebooted by TotalHeal.
• Every install is signed and auditedEach install is a signed command with an approval level and an audit entry.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• TotalHeal desktop agent or Linux server agent enrolled to your organisation
• Devices can reach their own update sources (Windows Update or WSUS, Apple, distribution mirrors)
• A TotalHeal DeviceSphere UEM entitlement (today)

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.