Managed Detect, respond, recover
Vulnerability and critical patch management
If your scanner lists thousands of findings and nobody owns the fixes, you're not alone. We find, prioritise and patch them for you, on a clock you agree.
- Critical patches
- [x] daysfrom vendor release
- Scanning
- Continuousinternal, external and cloud
- Patching
- OS + appsincluding third-party software
- Reporting
- Monthlyone number for the board
01 / The problem
Too many findings. Not enough hours.
Scanners don't prioritise
A raw scan lists every CVE (known vulnerability) it finds. It doesn't tell you which ones attackers are using.
Third-party apps get missed
Windows updates usually happen. Browsers, PDF readers and runtimes often don't.
No number for the board
"We patch regularly" isn't evidence. Boards, auditors and insurers want a figure they can track.
02 / What’s included
Find, prioritise, fix, prove.
Continuous scanning
Regular scans of your internal network, internet-facing systems and cloud, so new assets don't slip through.
Risk-based prioritisation
Findings ranked by whether they're being exploited, how exposed the system is and what it does for you.
Operating system patching
Windows and macOS updates tested, scheduled and deployed for you.
Third-party patching
Browsers, PDF readers, Java, collaboration apps and other common software kept up to date.
Critical patch clock
Critical and high-risk fixes applied within [x] days of release, with an emergency route for the urgent ones.
Monthly reporting
Patch compliance, open exposure and the trend over time, in a report your board can read.
[Placeholder: offer for this service, written by ITB]
03 / How it works
From first scan to a number you can track.
- Discover We find what's on your network and in your cloud, including the things nobody listed.
- Scan and prioritise We scan, then rank findings by real-world risk rather than raw severity.
- Patch in rings Updates go to a test group first, then the rest, inside agreed maintenance windows.
- Verify and report We rescan to confirm each fix, then report the numbers monthly.
A list of vulnerabilities isn't a service. Closing them is.
How ITB runs patching
04 / Why ITB
Scan it yourself, or have it fixed.
Because we also run SOC and EDR for clients, we see which vulnerabilities attackers are using right now. That shapes what we patch first.
| What it takes | Do it yourself | With ITB |
|---|---|---|
| Scanner licences and upkeep | Bought and run by you | Included |
| Deciding what to fix first | Your team, from raw scores | Ranked for you by real-world risk |
| Third-party app patching | Often left to users | Included |
| Critical patch deadline | Best effort | [x] days, agreed and reported |
| Evidence for audits and insurers | Pulled together by hand | Monthly report |
· 05 / Questions
Patch management, plainly answered.
Q01 What's the difference between a vulnerability scan and a penetration test?
A scan is automated and finds known weaknesses across your estate. A penetration test is done by a person, who tries to exploit and chain those weaknesses. You need the scan continuously and the pentest periodically.
Q02 How quickly do you apply critical patches?
Within [x] days of the vendor's release, and faster for anything being actively exploited. Cyber Essentials requires high and critical updates within 14 days, so our target sits inside that.
Q03 Will patching break things?
Updates go to a small test group first, then the wider estate, inside maintenance windows you agree. If an update causes a problem, we pause it and roll back.
Q04 What about systems we can't patch?
Some kit is too old or too fragile to update. We record it, limit who and what can reach it, and agree a plan to replace it.
Q05 Can this work alongside our IT team or MSP?
Yes. We can run patching end to end, or handle scanning and prioritisation while your team deploys. We agree who does what at onboarding.
Related services
Managed SIEM / SOC
Fewer open holes means fewer alerts.
See the serviceEDR / XDR / MDR
Protects the endpoints while patches are on their way.
See the serviceCyber Essentials & IASME
The 14-day patching rule is one of its controls.
See the servicePenetration Testing
A person testing what scanning can't.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]