Patch & Vulnerability Management

Automated patching of your in-scope servers to agreed maintenance windows, vulnerability scanning, prioritised remediation, a rescan to confirm each fix, and reporting on patch status, vulnerability trend and agreed exceptions.

Windows Server estates running supported operating system versions, on-premises and in the cloud. In-scope servers, supported versions and maintenance windows are agreed during service design.

We run a regular monthly cycle against your agreed windows, and we run out-of-band patching for critical or actively exploited vulnerabilities rather than waiting for the next cycle.

We assess exposure across your estate, agree an emergency change with you and remediate out of cycle. Where no patch exists yet, we agree mitigation and record the residual risk until the vendor releases a fix.

Patches are deployed in a staged way, starting with lower-risk groups, so problems surface before they reach your critical servers. Where a patch causes an issue we roll it back under change control and agree the next step with you.

We rescan after remediation and report the result. You see what was found, what was fixed, what remains open and why, rather than a list of patches we pushed.

Some findings sit in software you control, in an unsupported version, or in a system that cannot take the update. We flag those, propose mitigation, and ask you to accept the remaining risk in writing so ownership is clear.

Yes. Our patching approach aligns to Cyber Essentials requirements, and the evidence we maintain supports certification, insurer questionnaires and client due diligence.

You pay a monthly charge per managed server, so cost tracks your estate and stays predictable as it grows. Your service schedule confirms the charging unit, in-scope servers and what is included.

We run discovery, establish a baseline vulnerability position, agree maintenance windows and risk appetite with you, then deploy patching and scanning against an agreed transition plan. The baseline scan tells you where you are starting from.

We do manage estates that sit outside our reference architecture. Where an unsupported version or an application dependency limits what we can patch, we tell you up front, what it means for your risk position and what it changes commercially.