About Patch Sanity

Patch Sanity exists because keeping systems patched shouldn't take a dozen browser tabs, three spreadsheets and a lucky guess. It's built by a systems engineer who has spent almost thirty years doing exactly that job, and who finally built the tool that job always needed.

Why it exists

Every month the same thing happens. Microsoft publishes its updates. The Linux distributions publish theirs, each in its own format. The network vendors post advisories on their own sites. CISA adds to its list of vulnerabilities already being attacked. NIST reviews CVEs on its own schedule, sometimes days or weeks behind. Somewhere in all of that is the one question that matters: what affects the machines I'm responsible for, how bad is it, and how do I fix it?

Answering that has always meant reading everything, by hand, and hoping nothing slipped through. Patch Sanity reads it all for you, every hour, from the sources themselves, and puts it in one place: Find it (Intelligence), Flag it (Inventory) and Fix it (Installation), with the reports to Prove it.

How it's built

Straight from the source. Every CVE, fix and score comes from the people who publish it, and every source is credited by name, with how fresh its data is.
Exploited first. What's being attacked right now matters more than a big score on paper, so actively exploited CVEs come first, with CISA's fix-by dates and how likely an attack is in the next 30 days.
Early, but honest about it. Early Alert shows new CVEs straight from the vendor's own record, often days before they're reviewed, and always clearly marked as not yet reviewed.
The fix, not just the problem. Each CVE shows which update fixes it for each version, and a script to check your own machines.
Private by design. Personal accounts, two-factor sign-in, each customer's data kept separate, no advertising and no tracking.
Built the way production systems should be. By someone who has spent years keeping regulated, always-on, customer-facing systems running, and who has sat on the other side of the table for security audits.

From the primary developer

I've spent 29 years keeping other people's computers running: the kind of work nobody notices until it stops.

I started at the desk-side in the late nineties: imaging PCs, chasing hardware faults, answering the phone at 3 a.m. Within a year I was leading a team of eight looking after more than three thousand people in 42 offices across 32 countries, and travelling overseas to consolidate and move those offices. Then came a decade running more than 350 Windows servers, and after that, nearly twenty years as a senior systems engineer responsible for the servers behind services that customers pay for, people's health records depend on, and contracts promise will be up.

Along the way: clusters, storage networks, load balancers, certificate authorities, virtualization, mail and collaboration platforms, databases from the late-nineties versions to this year's, every Windows release since 3.11, Linux servers, and a great deal of automation. And the one thing that never went away in any of those jobs: patching. Finding out what's affected, deciding what can wait, testing, rolling it out, proving it was done, and being the one on call if it goes wrong.

"If I don't know it, I will learn it."

That line has been on my résumé for decades, and it's how Patch Sanity got built: one evening at a time, reading every vendor's feed until it made sense, then making a computer read them instead.

Outside the server room

The urge to take things apart and build them better doesn't stop at work. I write, record and mix music; design and 3D-print things that didn't exist the day before; build PCs from bare metal; take photographs and edit video; and I've hosted my own websites and servers since long before "the cloud" had a name. This site runs on servers I set up myself.

It's the same habit every time: notice something that's harder than it should be, then make it simpler. Patch Sanity is that habit, pointed at the job I know best.

Try it on your own browser

Browser Check is a small, free piece of Patch Sanity anyone can use without signing in: it checks the browser you're on, and its operating system, against the newest releases and the security fixes we track, with a link to update each. It also shows everything a website can see about your machine. Nothing is saved.

What's next

Patch Sanity is in a private beta. Intelligence and the reports are here today; Inventory (your own machines, matched against every CVE) and Installation (pushing the fixes out, on a schedule you approve) come next, then version 1.0.

Questions or ideas? Reply to any Patch Sanity email. Found a security problem in Patch Sanity itself? Please tell security@patchsanity.com.