Update Sentinel
Sign inStart free trial
How it works

Up and running in four simple steps.

No servers to build. No consultants to hire. Just a small relay at each site and a clear screen to run it all from.

Create your account

Sign up at app.updatesentinel.com. Your organization is ready to go right away.

A few minutes

Add a relay to each site

Install it on a Windows or Linux machine you already have. One command does it.

One per site

Add your machines

Install the small agent. You approve each machine before it can join.

Quick, silent install

Approve and schedule

Pick the updates, choose who gets them first and set a pass mark.

You're patching
The big idea

One relay at each site does the local work.

Your plant talks to one relay. The relay talks to the cloud when it can. Flip the switch to see what happens when it can't.

How Update Sentinel keeps patching when the internet dropsThe Update Sentinel cloud connects to a relay inside your plant. The relay serves approved, signed updates to machines on the plant network. If the internet link is cut, the relay keeps serving the updates already approved and results sync later.YOUR PLANT NETWORKInternet link downUpdate Sentinel cloudPlan, approve and reportSite relayCaches signed updatesOperator HMIEng. workstationHistorianSCADA serverLine PC

Plans, approvals and results sync with the cloud.

Sealed sites

Never connected? Updates arrive on USB.

A transfer relay where there is internet writes a signed bundle to a USB drive. At the sealed site, the main relay checks every file and serves the updates.

USB transfer to a sealed siteIn the connected zone, a PC or laptop running the relay (the transfer relay) syncs with relay.updatesentinel.com and downloads Microsoft update files from catalog.s.download.windowsupdate.com, both over HTTPS port 443, and writes a signed transfer bundle to a USB drive. The drive is carried across the air gap to the main relay in the sealed zone, which verifies the bundle and serves the updates to its agents on TCP 7443. The sealed zone has no connection to the outside.Update Sentinel cloudrelay.updatesentinel.comMicrosoft Update CDNcatalog.s.download.windowsupdate.comCONNECTED ZONETransfer relayA PC or laptop running the relayWrites signed bundles to USB1HTTPS 4432HTTPS 443AIR GAPUSBSigned transfer bundleCarried across by handSEALED ZONE: NO OUTSIDE CONNECTIONMain relayVerifies every file in the bundleServes updates to the siteAgentAgentAgent4TCP 7443

Hosts and ports for your firewall are listed on the Platform page.

A typical month

What Patch Tuesday looks like now.

Microsoft ships fixes on the second Tuesday of each month. With Update Sentinel, five steps take it from release to report.

Try it on your next Patch Tuesday
New updates show up for reviewNothing installs yet. You see what's new, which CVEs it fixes and whether any are being exploited.
You approve what you wantSkip anything you're not ready for. Your call, every time.
Relays download and check them onceEach file is verified before any machine sees it.
Pilot group first, then everyone elseEach ring must pass before the next one begins.
Your compliance report updates itselfReady when the auditor or your boss asks.
What you'll need

Short list. Probably already in the building.

One relay machine per site

  • A 64-bit Windows or Linux machine
  • Room on disk for cached updates
  • A path out to the internet now and then, or a USB drive for sites that are never connected

The machines you want patched

  • 64-bit Windows desktops and servers
  • Ubuntu, Debian, Red Hat family or SUSE Linux
  • A network path to the site relay

A person, not a team

  • Anyone who can install software on those machines
  • No database or web server skills needed
  • Want the details? See Platform
Questions

Common questions.

Your next Patch Tuesday could be the easy one.

Set up a relay, add a few machines, and watch your first rollout finish on schedule.

Start your free trial
7-day free trial · No sales call needed