How Patch Sanity works
Patch Sanity follows the security flaws (CVEs) in operating systems, apps, network gear and hardware, puts the ones being attacked first, and shows the fix for each version. Then it checks your own machines and websites against them.
The tour
Patch Sanity is built around three steps, Find it, Flag it and Fix it, with three more tabs alongside them.
Intelligence
Every CVE we track, newest data first, filtered to the systems you look after. Exploited CVEs come first, with CISA's fix-by dates, how likely an attack is in the next 30 days, and whether working exploit code is public. Each CVE has its own page with the fix for every version.
Inventory
Your own machines, and which of those CVEs each one is missing the fix for. Managed Devices report by themselves, as often as you choose from every hour to once a day (Linux and Windows so far), a Sanity Check is a one-time look at any computer, and SBOMs (software bills of materials) are checked component by component. Newer versions of each machine's other programs are listed too.
Installation
Coming later. Rolling the fixes out, on a schedule you approve.
Early Alert
New CVEs straight from the vendor's own record, often days before NIST's National Vulnerability Database reviews them, and always clearly marked as not yet reviewed.
Server Sanity
Your websites and servers, checked every 10 minutes: are they up, are their certificates about to expire, are their email records (SPF, DKIM, DMARC) in order. You're emailed when something goes wrong, and again when it's fixed.
Reports
Ready-made reports, such as the exploited CVEs with no fix listed yet, your machines and what they're missing, and the health of your websites and email.
How it treats your machines
Patch Sanity isn't trying to take over your machines. It reads and reports; it doesn't install or change anything on them.
- The scripts it gives you only read: the operating system's version, its installed updates and its installed software. Each one is plain text you can read before you run it.
- A one-time Sanity Check shows you its results first and sends nothing unless you say so.
- Machines that report by themselves check that each update to their script is signed before they use it, so a break-in at Patch Sanity can't change what your machines run from one day to the next.
- Our server can't send commands to your machines. When installing fixes arrives, it will be something you approve.
More about us
Why Patch Sanity exists, where its data comes from, how it keeps each team's data private, and who builds it are on the About page. It's in a private beta, by invitation.
Watch the Demo About Patch Sanity · Try Browser Check (free, no sign-in) · Sign in
Patch Sanity is a guide, not a guarantee: always confirm with the vendor's own advisory. See the disclaimer & terms of use.