What PatchPilot does
PatchPilot keeps the servers and workstations you manage up to date. It shows which updates each host is missing, which known vulnerabilities (CVEs) those updates fix, and installs them when and how you decide.
The two parts
The portal is where you work: your devices, their updates and vulnerabilities, patch jobs, policies, reports and users. You reach it in a browser at your organization's portal address.
The agent is a small program you install on each host. It runs as a service, reports the host to the portal, and installs updates when the portal asks it to.
The agent only ever connects out to the portal over HTTPS. The portal never connects in to your hosts, so no inbound firewall port has to be opened.
What the agent uses on each system
| System | Updates come from |
|---|---|
| Ubuntu and Debian | apt, from the repositories the host already uses |
| RHEL, Rocky Linux, AlmaLinux, Oracle Linux | dnf or yum, from the repositories the host already uses |
| Windows | Windows Update (or your WSUS server), and winget for third-party programs such as Chrome, 7-Zip and Zoom |
| macOS (In testing) | Apple's softwareupdate, and Homebrew where it is installed |
PatchPilot does not replace your repositories or mirror your updates. A host installs exactly what its own sources offer, with their signatures checked as usual.
What happens after a host joins
- Within a minute the host appears under Devices with its operating system, version, IP addresses and agent version.
- Straight away the agent sends its list of installed software and checks which updates are available. From then on it checks again every six hours, and whenever you press Scan now.
- Vulnerabilities are matched against the installed versions and shown on the device and under Vulnerabilities, each marked as having a fix available or not.
- You patch either by hand, with a patch job from the device or Jobs page, or automatically, with a policy that runs in a maintenance window you choose.
The agent reports every minute. A host that has not been heard from for three minutes is shown as Offline, and can send you an email when it happens (see your notification settings).