Windows
Security, critical and cumulative updates and drivers through Windows Update; browsers, tools and business apps through winget.
Windows Updatewinget
Included in TeamFrom CVE to installed patch, without switching tools →
Patch what’s exploited first.
The TechWatchAlert agent installs Windows, Linux and macOS updates, OS and third-party software. Every patch carries the CVEs it closes: fixes for exploited vulnerabilities go first, the rest follows your approvals, your rings and your maintenance windows.
14-day Team trial, no credit card · Windows, Linux and macOS agent · hosted in France
Updates
Updates missing on machines running the agent, most urgent first: decide, then deploy.ApproveDeploy now…
AllTo decideApprovedRejected
| Update | Category | Machines | CVE | Published | Restart | Decision | |
|---|---|---|---|---|---|---|---|
| Cumulative Update for Windows 11 24H2 (KB5066835)Windows Update · restart | Security | 38 | CVE-2025-59230 +5 | Oct 14 | ⟳ | Approved | |
| Google Chrome 140.0.7339.185winget · 139.0.7258.155 → 140.0.7339.185 | Software | 52 | CVE-2025-10585 | Oct 17 | — | Approved | |
 macOS Sequoia 15.6.1Apple Software Update | Security | 11 | CVE-2025-43300 | Oct 20 | ⟳ | To decide | |
 opensslAPT · 3.0.13-0ubuntu3.6 | Security | 17 | CVE-2025-9230 +2 | Oct 23 | — | Approved Held back until Oct 30 | |
| 7-Zip 25.01winget · 24.08 → 25.01 | Software | 9 | CVE-2025-0411 | Oct 9 | — | To decide | |
| Intel Display 32.0.101.6078Windows Update | Driver | 6 | — | Oct 2 | ⟳ | Rejected |
6 updates, most urgent first
OS and third-party software, on all three systems
One agent, for x64 and ARM, that reads and installs what each machine’s native package managers offer. No WSUS to maintain, no repository to host.
Linux
Every package in the distribution, with the installed version and the one that fixes it.
APTDNFYUMZypper
macOS
System updates through Apple Software Update, and software installed with Homebrew.
Apple Software UpdateHomebrew
Two tools, and a gap in between
The scanner knows what is vulnerable. The patch tool knows how to install. In between, someone copies lists by hand, and exploited vulnerabilities wait for the next Patch Tuesday like everything else.
The scanner
Finds, but doesn’t fix
Thousands of CVE rows, exported to a spreadsheet, then handed to the team that patches. The day the vulnerability is exploited, nobody knows whether the patch went out.
The patch tool
Fixes everything, without triage
Everything goes out at the same pace, usually monthly. It doesn’t know which update closes a vulnerability exploited this morning, or which one can wait.
TechWatchAlert
Fixes what’s exploited first
The same platform matches CVEs to your machines, knows which ones are exploited and installs the patch. Straight from the alert, in one click, with the proof.
Built to patch fast without breaking anything
The newest patches wait a few days; those that close an exploited vulnerability go out right away.
Update sources
8Windows Update, winget, APT, DNF, YUM, Zypper, Apple Software Update, Homebrew
Agent
Windows, Linux and macOS, x64 and ARM
Deferral period
7 dby default, and 0 for the fix of an exploited vulnerability
Open ports on the machine
0the agent calls the platform over HTTPS, never the other way round
Four steps, no server to install
The console runs on our side, the agent on yours. The fleet starts in observation mode: no scheduled policy runs until you decide it should.
Install the agent
One command per system, or the scripts provided for Datto, NinjaOne, ConnectWise Automate, N-able and Atera. An enrollment token can place machines in a group and tag them.
See what’s missing
Every machine is scanned regularly, and on demand. Missing updates are listed with their CVEs, their size and the restart they require.
Decide
Approve or reject for the whole project, with a reason. Pending security approvals can also be handled from your phone.
Deploy and keep the proof
Right away, later or through a scheduled policy. Every task, every failure and every decision stays in the log.
Everything you need to patch without breaking things
The safeguards of an enterprise patch tool, tuned by knowing what is actually being exploited.
From alert to patch
An exploited vulnerability? The patch ships from its case
On each alert’s page, TechWatchAlert lists the updates that fix the CVE and the machines still missing them. One click, a maintenance window, and the deployment is under way.
- The “Deploy with the agent” button on every affected alert
- Machines still exposed, counted one by one
- Every deployment written to the audit log
CVE-2025-59230
Windows Remote Access Connection Manager · elevation of privilegeKEV Fix within 3 days Remediating
Deploy with the agent
2 updates fix this vulnerability, pending on 7 machines.
| Cumulative Update for Windows 11 24H2 (KB5066835) | 5 machines |
| Cumulative Update for Windows Server 2022 (KB5066782) | 2 machines |
When
NowLater
Maintenance window
4 h
Deploy to 7 machines
Deferral period
Patches that are too fresh wait. Fixes for exploited vulnerabilities don’t
An update published less than seven days ago is held back: time for regressions to surface somewhere other than on your network. If it closes a CVE listed in the CISA or VulnCheck KEV catalog, or one that CERT-FR reports as exploited, it goes out right away.
- Period adjustable from 0 to 90 days, policy by policy
- Exception for exploited vulnerabilities, on by default
- You can still force a deployment, and it is logged
Example: policy with a 7-day deferral period
Workstations · ring 2
Criteria
Deferral period7 days
Never hold back the fix for an exploited CVE
Preview
| Google Chrome 140.0.7339.185Published 2 days ago · closes CVE-2025-10585, in KEV | Goes out now |
| openssl 3.0.13-0ubuntu3.6Published 2 days ago · no exploited CVE | Held back 5 days |
| Cumulative Update (KB5066835)Published 9 days ago | Period over, goes out |
Ring deployment
A pilot group first, the whole fleet next
Each ring only deploys what the previous ring has installed without a single failure for the number of days you chose. A patch that breaks something stops at the pilot.
- Validation of 0 to 60 days between two rings (3 by default)
- A preview of every run, with the reason for everything left out
- Criteria by source, category and severity, plus exclusions
Update policies
1
IT pilot12 machines · Tuesday 02:00, Europe/Paris
Succeeded2
WorkstationsRing 2 · after “IT pilot”, validated for 3 days
Running3
Production serversRing 3 · after “Workstations”, validated for 7 days
Next run: Nov 4Scheduling and restarts
The right day, the right time, no surprises for users
Daily, weekly, monthly or “Patch Tuesday + 1 day”, at the time in the time zone you choose. A machine that hasn’t started before the window closes gives up. Restarts follow your policy: never, if required or always, with your message.
- Maintenance window from 15 minutes to 7 days
- Delay before restart, and maximum deferral allowed to the user
- Pending restarts counted on the fleet dashboard
Deployment
SchedulePatch Tuesday + 1 day
Maintenance window240 minutes
RestartIf required
Delay before restart15 minutes
Maximum deferral4 hours
Message shown to the user
Your computer will restart to finish installing security updates. Please save your work.
Dynamic groups
Target by rules, and the fleet sorts itself
System, name, tag, criticality, environment, source or status: groups are recalculated every time they are used. A machine enrolled tomorrow lands in the right ring without anyone touching it.
- Up to 20 conditions per group
- Preview of the matching machines
- Static groups when you need them
Production Linux servers
SystemisLinux
andEnvironmentisProduction
andTagis notchange-freeze
42 machines matchPreview
Traceability
Who decided what, what went out, what failed
Every approval, every deployment and every restart is written to the audit log. A failed, rejected or expired task opens an item to handle for the project’s administrators, with reminders.
- Run history, by status and by machine
- Script output kept for 180 days
- Automatic reminders until a failure is handled
Run history
- “Workstations” policy ranScheduled · 64 machines · 61 succeeded, 3 running
- Maintenance window openedPatch Tuesday + 1 day · Europe/Paris
- Sophie Martin approved 4 updatesIncluding KB5066835 and Google Chrome 140
- Marc Lefèvre rejected an updateIntel Display driver · reason: known regression
- Task failed on PC-COMPTA-07Item to handle opened · automatic reminder
The agent patches. Connectors cover everything else
60 connectors link TechWatchAlert to the tools you already use: machines without the agent join the same fleet, devices no agent can update stay monitored, and every patch can be verified.
Machines without the agent
Workstations and servers already managed elsewhere join the same fleet: their software is matched against CVEs, even where the agent isn’t installed.
What no agent can update
Hypervisors and firewall appliances are updated by hand. Connectors read their exact version and warn you as soon as a vulnerability targets them: you know what to schedule, and on which device.
Proof the patch took
Your scans, imported or read through the scanner's API, checked against your cases: a patch reported as applied that the scanner still sees as missing stands out, host by host.
The right person notified
The alert goes out as a ticket (Jira, GLPI, ServiceNow…), a Teams card or a Slack message, and as a signed webhook to your scripts; security events also go to your SIEM.
An agent that only runs what you approved
Installing software across the whole fleet calls for a high level of trust. Here is what earns it.
Signed tasks
Every task is signed by the platform, and the agent checks that signature before acting. It only installs what is listed in the signed task it receives.
No open ports
The agent contacts the platform at regular intervals, over an encrypted outbound connection. Nothing listens on the machine, no inbound firewall rule.
Observation mode at the start
A new fleet starts in observation mode: scheduled policies and automatic agent updates wait for your go-ahead. Your manual actions remain possible.
Scripts disabled by default
An administrator allows them for the project, and a machine can refuse them locally from installation onwards.
Secrets never stored in plain text
Each agent authenticates with its own secret; the platform never stores it in clear.
Hosted in France
Application, database, backups and email at OVHcloud, in data centers in the Paris region.
What neither the scanner nor the patch tool does alone
| Vulnerability scanner | Traditional patch tool | TechWatchAlert | |
|---|---|---|---|
| Sees the CVEs on each machine | |||
| Knows which ones are exploited (KEV, CERT-FR, EPSS) | |||
| Installs OS and third-party software patches | |||
| Shows the CVEs closed by each update | |||
| Lets the fix for an exploited vulnerability through right away | |||
| Deploys from the alert itself | |||
| Keeps case, decision and proof in one place |
Yes · Partly, depending on the tool · No
Comparison by tool category, not by vendor: exact features vary from one product to another.
Patch management, plan by plan
All prices exclude VAT. 14-day Team trial with no credit card, deployment included.
Free
See what’s missing
€0
Forever
Start for free- Windows, Linux and macOS agent
- Inventory and missing updates for each machine
- CVEs closed by each update
- 5 machines included
Team
Patch the whole fleet
€149.17/month
billed annually · 100 machines included
Try it for 14 days- Everything in Free, with 100 machines included
- Approve, reject, deploy, install, uninstall
- Deployment from the alert
- Maintenance windows and restart policy
- Deferral period and exception for exploited vulnerabilities
- Audit log
Enterprise
Automate at scale
From€6,000
per year, on quote
Talk to the team- Everything in Team, unlimited machines
- Scheduled ring policies
- PowerShell, bash, Python scripts
- Also available as an add-on to Team
Additional machines: €2.50 per machine per month. MSPs: volume pricing down to €0.90 per machine per month.
Compare all plans →
Which systems and software are covered?
Windows, Linux and macOS, on x64 and ARM. On Windows: Windows Update (security, critical, cumulative, drivers) and winget for third-party software. On Linux: APT, DNF, YUM and Zypper, so every package in the distribution. On macOS: Apple Software Update and Homebrew.
Do I need a WSUS server or an open port?
No. The agent calls the platform over HTTPS and downloads updates from each system’s usual sources. Nothing listens on the machine and there is no server to install on your side.
How do I keep an update from breaking production?
Three safeguards work together. The deferral period holds back patches that are too recent for seven days. Approvals let you reject an update, which will then never go out. Rings only deploy to production what the pilot group installed without failure.
What if a patch causes problems once installed?
TechWatchAlert does not uninstall a patch that has already been applied: that is exactly why the deferral period, the pilot and approvals exist. You can, however, uninstall software through winget, APT, DNF or Homebrew, and run your own remediation scripts.
How are exploited vulnerabilities handled?
When an update closes a CVE listed in the CISA or VulnCheck KEV catalog, or one that CERT-FR reports as exploited, it doesn’t wait for the deferral period. From the alert, the “Deploy with the agent” button lists the patches and the machines still exposed.
Does it replace my RMM or Intune?
Not necessarily. Many teams keep their management tool and hand the vulnerability and patching side to TechWatchAlert. The agent installs with one command, and scripts are provided to push it from Datto, NinjaOne, ConnectWise Automate, N-able and Atera. Without deploying the agent, TechWatchAlert can also read the inventory of NinjaOne, Datto RMM, N-able N-central and Atera through their API.
How much does it cost?
Seeing missing updates is free for up to 5 machines. Deployment is included in Team, €179 per month for 100 machines (less when billed annually), then €2.50 per additional machine. Rings and scripts are in Enterprise, or available as an add-on to Team. Prices exclude VAT.
Does it help with NIS2?
Article 21 of NIS2 requires vulnerabilities and their remediation to be managed. For each vulnerability, TechWatchAlert keeps the decision, the patch deployed, the date and who made it: enough to show an auditor what was done, and when.
Where is the data hosted?
In France, at OVHcloud, in the Paris region: application, database, backups and email. TechWatchAlert’s publisher is based in France.
Patch management
Detect, then fix without switching tools
The agent reports the inventory, TechWatchAlert prioritises what is exploited, and the fix ships in the window you chose.
Free plan, no credit card · hosted in France