Skip to content

Endpoint Patch Management

CyberArmor delivers automated, policy-gated software patch remediation through the same endpoint agent that carries AI governance to the device. Patching runs across Windows, macOS, and Linux using each host's native package manager.

What it does

  • reports every endpoint's upgradable software with current and available versions
  • applies patches through native package managers (no separate agent to install)
  • gates every patch behind a per-tenant policy: maintenance windows, approval, and optional per-app auto-approve
  • runs every patch through the audited privileged-action broker, producing decision-level evidence
  • prioritizes remediation using the A-BOM's CVE / CISA KEV / FIRST EPSS data

Supported package managers

Platform Manager Identifier example
Windows winget Mozilla.Firefox
macOS Homebrew cask firefox
Linux (Debian/Ubuntu) apt firefox
Linux (RHEL/Fedora) yum / dnf firefox

Entitlement

Patch management is a per-tenant paid capability. Patch commands are rejected at the enqueue chokepoint unless the tenant is entitled:

  • GET /tenants/{tenant_id}/patch-management — read entitlement (admin)
  • PUT /tenants/{tenant_id}/patch-management — grant/revoke (admin)
  • GET /customer/patch-management/entitlement — tenant reads its own status

How a patch runs

  1. the agent scans for upgradable software — on its scheduled sweep, or on demand when a tenant admin triggers a scan — and reports the result to POST /agents/{agent_id}/patch-scan/ingest
  2. a tenant admin approves updates from the portal (POST /customer/patch-management/approve), which enqueues patch_apply commands server-side, scoped to that tenant's own agents and gated by the entitlement
  3. the agent polls GET /agents/{agent_id}/commands/pending, runs the patch through the audited broker, and reports the result
  4. the result — including before/after version — is stored on the AgentCommand record as the patch-compliance audit trail

Tenant admins drive the whole flow from the customer portal without platform-admin access:

  • POST /customer/patch-management/scan — refresh the upgradable inventory on demand (whole fleet, or one agent_id)
  • GET /customer/patch-management/updates — the current upgradable inventory
  • POST /customer/patch-management/approve — approve selected updates (schedule: "now" or "window")
  • GET /customer/patch-management/jobs — patch job history

CyberArmor operators can do the same across tenants via the /tenant-patch-*/{tenant_id} admin equivalents.

Policy controls

  • Maintenance windows — patches scheduled to a tenant's allowed window rather than applied immediately
  • Approval gate — the default; nothing patches without an explicit admin approval
  • Per-app auto-approve — an optional allowlist for apps a tenant trusts to patch automatically

Validation checklist

  • PUT /tenants/{tenant_id}/patch-management sets the entitlement
  • POST /agents/{agent_id}/patch-scan/ingest stores the endpoint's upgradable list
  • an un-entitled tenant receives 403 when a patch_apply command is enqueued
  • a completed patch_apply command shows before_version and after_version in its result

See also Endpoint Agent and Endpoint Detection.