Defend
Patching and vulnerability management
Attackers rarely need something new. Patching rolls updates out from one place, in waves; vulnerability management finds the gaps that remain and closes them.
The gap was usually known. The patch was usually out.
The vulnerability an attacker uses has usually been public for weeks, in a system that hasn’t been updated, and insurers know it: unpatched systems are one of the things they ask about, and have refused claims over. Patching is the routine: operating systems and applications kept current from one place, on every device, in waves that start with a pilot group. Vulnerability management is the check behind it: what the patching missed, the device that isn’t on the list, the software that nobody updates, the setting that leaves a door open. Found, ranked by what it would mean for your firm, and closed, with the patch level on record.
What we set up
Updates in waves, the rest found and closed.
One routine for every device your firm runs, and one check that catches what the routine can’t reach.
-
From one place, every device
Windows, the Microsoft 365 apps and the applications your work runs on are updated from one place: laptops, workstations and servers alike. A device that isn’t on the list isn’t updated, so enrolment comes first.
-
Pilot group first, then the rest
Every patch goes to a pilot group first, then to the rest of the firm in waves, with a deferral that keeps a bad update away from everyone at once. Our own scripts pass more than 150 test scenarios before they touch a client’s device.
-
Patch windows agreed with your rhythm
Laptops update in the background and restart when the person is ready; servers restart in a window agreed with you, outside working hours. Not in the week of a submission or a filing deadline.
-
The gaps that remain, found
Devices and servers are checked for known vulnerabilities: missing patches, software past its support, settings that leave a door open. The check runs regularly, not once a year before the questionnaire.
-
Ranked by your risk
Not every finding is urgent. Each one is ranked by what it would mean for your firm, and your TechPilot decides with you what is closed first, what waits for the next window, and what is accepted, with a reason and a date.
-
Closed, and on record
A gap is closed by a patch, a setting, a replacement or a change on the roadmap. What was found, what was done and what is still open is in your evidence file, so “Are your systems patched?” has an answer with a date.
On record
In your evidence file.
- Every device and server with its patch level
- The patch windows and rings, as they are set
- The findings of the last vulnerability check, each with its rank and its state
- The accepted gaps, each with its reason, its owner and its date
Ready for the insurer’s question about patching, and the client’s question about known vulnerabilities.
What usually goes wrong without it.
-
The device no update reaches
The conference-room PC, the plotter’s print server, the old laptop: not on the list, so two years behind. The gap an attacker uses is on the machine nobody thought of.
-
Everything at once, on a Tuesday
Without rings, a bad update reaches every device on the same morning, and the whole firm stops instead of the pilot group.
-
Software past its support
An application the firm depends on stopped getting patches years ago. No update will ever close its gaps, and nobody has put a replacement on the roadmap.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
Do updates interrupt our people?
Laptops update in the background and ask for a restart when the person is ready. Servers restart in a window agreed with you, outside working hours. The weeks around a deadline are kept clear.
What if an update breaks something?
That is what the pilot group is for: a bad update reaches a few devices, is noticed and held back before the next wave. Our own scripts are tested before they touch a client’s device, and a change can be rolled back.
What about software you don’t update, like our practice or CAD software?
We update the software your work runs on where its vendor supports it, and work with the vendor where a version has to match a project or a hosted environment. What can’t be updated is a finding: ranked, decided with you, and on the roadmap.
Can you show an insurer our patch level?
Yes. Every device with its patch level, the last vulnerability check and the accepted gaps with their reasons are in your evidence file, as they are, with a date.
Start
Which of your systems is two years behind?
In a first call we go through how updates reach your devices and servers today, what isn’t on any list, and what a vulnerability check would find.
- No first level
- No surprises
- Pilot before you buy