Update SentinelNo internet, by design
- Plant networks are isolated for good reason
- Keeping updates moving takes extra work
- Patch status can be hard to see across machines
Now in early access · Try every core feature free for 7 days
Keep your plant patched. Even when it's offline.
Patch Windows, Linux, and approved third-party applications around your maintenance schedule. Keep approved updates moving across your sites, even when the internet connection is down.
- 7-day free trial
- No sales call needed
- Runs on hardware you already have
Patches the operating systems your sites already run
WindowsWindows ServerUbuntuDebianRed Hat Enterprise LinuxSUSERocky LinuxAlmaLinux
The problem
Patching the plant floor shouldn't feel like a gamble.
The machines that run your operation are often the hardest ones to keep up to date.
Downtime is expensive
- Production leaves little room for unplanned downtime
- Patching has to fit scheduled maintenance
- The backlog grows while updates wait
WSUS is winding down
- Microsoft stopped new WSUS development in 2024
- Its cloud replacements expect internet-connected PCs
- Plants need a replacement that works offline
Why it matters now
Attackers aren't waiting for your next shutdown.
1,721Known exploited vulnerabilities in CISA's catalogCISA KEV catalog, Sept. 2026
119Ransomware groups that hit industrial companies in 2025, up from 80Dragos OT Year in Review 2026
43daysMedian time to patch, up from 32 days the previous yearVerizon DBIR 2026
2 in 3Industrial ransomware victims that were manufacturersDragos OT Year in Review 2026
The list of actively exploited flaws keeps growing
Vulnerabilities in CISA's Known Exploited Vulnerabilities Catalog, cumulative
| 2021 | 311 |
|---|---|
| 2022 | 866 |
| 2023 | 1,053 |
| 2024 | 1,239 |
| 2025 | 1,484 |
| 2026 | 1,721 |
2026 is year to dateSource: CISA
Microsoft has the most known exploited vulnerabilities
Entries in CISA's Known Exploited Vulnerabilities Catalog, by vendor
| Microsoft | 388 |
|---|---|
| Cisco | 99 |
| Apple | 94 |
| Adobe | 81 |
| 75 | |
| Oracle | 46 |
For plants that run Windows, timely patching is critical.Source: CISA, Sept. 2026
The fix
Patching that fits how plants run.
Built for sites where uptime comes first and the internet is optional.
Keep patching through connection outages
A local relay keeps approved updates available to your machines when the outside connection drops.
Patch fully disconnected sites Patents Pending
Bring approved updates into sites with no outside network connection. Every file is verified before use.
Keep essential apps current
Update approved browsers, PDF readers, and runtimes from the vetted Application Catalog. Request additions when your sites need them.
Patch around production
Install only inside Rollout Windows set around production, and pause or resume when plans change.
Test a small group first
Start with a few machines in Ring 1. Each later ring waits until the one before it passes its Promotion Gate.
A record you can verify Patents Pending
Keep a tamper-evident history of changes to support reviews, audits, and ongoing patch reporting.
Try it yourself
Cut the internet. Patching keeps going.
See how the site relay keeps approved updates available when the internet connection drops.
Plans, approvals and results sync with the cloud.
Sites that never connect can receive verified updates through offline transfer. See how it works.
Safe rollouts
Start with a few machines. Then roll out to the rest.
- Test updates on a few machines in Ring 1
- Set a Promotion Gate between each pair of rings
- Move ahead automatically when a ring passes, or wait for a person's sign-off
- Pause, resume, or stop from one screen
Example rollout4 rings
1 · Pilot100%
2 · Line A98%
3 · Plant 164%
4 · Plant 2Waiting
Promotion Gate: 95% success. Plant 2 becomes eligible only after Plant 1 meets it.
Vulnerability intelligence
See which machines still need critical fixes.
- See CVE IDs and severity scores for missing updates
- Identify vulnerabilities listed as actively exploited by CISA
- Track each machine from open exposure to remediation
How we stack up
Built to work on the plant floor.
Compare the capabilities that matter when maintenance windows are tight and connectivity is limited.
What you need | Update Sentinel | Cloud patch toolsAutomox, Action1, and similar tools | WSUSMicrosoft's on-premises tool |
|---|---|---|---|
| Keeps patching when the internet is down | |||
| Managed from the cloud with only a lightweight relay on-site | You run the server | ||
| Staged rollouts with automatic gates between rings | |||
| Windows and Linux in one place | |||
| Approved third-party apps, not just operating system updates | Microsoft only | ||
| Delivers updates to fully disconnected sites | Manual export and import | ||
| Tamper-evident audit trail | Activity logs | ||
| Actively developed with new features | Deprecated 2024 |
Industries
Made for the places that keep the lights on.
Sources. CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (cisa.gov). Dragos 2026 OT/ICS Cybersecurity Year in Review (dragos.com). Verizon 2026 Data Breach Investigations Report (verizon.com). Siemens, The True Cost of Downtime 2024 (summary). Microsoft, Windows Server deprecated features (learn.microsoft.com).
Your next Patch Tuesday could be the easy one.
Set up a relay, add a few machines, and see your first rollout finish on schedule.
7-day free trial · No sales call needed