Patch management and endpoint hardening
Most intrusions use a flaw that already has a fix, or a setting that was never tightened. Patch management is the routine of finding every device, testing updates on a small ring, rolling them out on a schedule and checking that they landed. Hardening is the matching work of turning off what the business does not use.
What we do
- Patch ring design and testing
- Baseline selection and exception tracking
- Local administrator password management
- Application allow-listing rollout
- Server and Linux patch windows
- Compliance and drift reporting
- Compensating controls for unpatchable devices
Our team works with Windows Update policy and update rings managed through Intune, with App Control for Business to allow only approved code, and with the CIS Benchmarks as a published baseline for Windows, Linux and macOS settings. For servers and Linux fleets we use Ansible to apply and re-check configuration, and for Windows administrator passwords we deploy Windows LAPS so each machine has its own local password.
This group links to our Managed IT Services and Cybersecurity practices. Some devices cannot be patched on a normal schedule, such as medical or factory equipment, and for those we plan segmentation and compensating controls. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Microsoft Intune
- App Control for Business
- CIS Benchmarks
- Windows Server Update Services
- Ansible
- Tanium
- Action1
Platforms and practices
- Windows Update rings and deadlines
- App Control for Business policies
- CIS Benchmarks baselines
- Windows LAPS local administrator passwords
- Ansible configuration enforcement
- Linux unattended security updates
- Third-party application patching
- Patch compliance reporting
References
- Microsoft Learn: Windows Update policy (Policy CSP)
- Microsoft Learn: App Control for Business
- Center for Internet Security: CIS Benchmarks
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Patch management and endpoint hardening for clients
Managed IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageHow fast should patches be installed?
It depends on risk. A common approach is to test on a small pilot ring within days, roll out to everyone within a short, defined window, and move faster for flaws that are being exploited, such as those on CISA's Known Exploited Vulnerabilities catalog. We agree the timeline with you in writing and report the percentage of devices that actually reached it.
What about devices that cannot be patched on schedule?
Some medical, factory and legacy systems cannot be updated without a vendor, a maintenance window or a recertification. For those we record the exception with an owner and a date, and add other controls: isolation in a restricted network segment, tight allow-lists, extra monitoring and removal of internet access.
What is the difference between patching and hardening?
Patching installs vendor fixes for known flaws. Hardening changes settings so that there is less to attack in the first place, such as turning off unused services, restricting what software may run and removing local administrator rights. A published baseline such as the CIS Benchmarks gives a checkable list, and we re-check it so settings do not drift.
Will hardening break our line-of-business applications?
It can, which is why we test first. We start in audit mode where the tool allows it, for example with App Control for Business, review what would have been blocked, and enforce only once the approved list is right. A rollback path exists for each change.