Unknown
Devices that never reached the register, added in a hurry, brought in by a vendor or left over from a project. Nobody patches what nobody knows about.
Solution · By Challenge
Unknown Assets & Unpatched Systems
You can't patch what you don't know exists, and you can't trust the status of what isn't reporting. IntelliAsset finds every device, gets an agent on it, shows what is missing and rolls out patches on your terms, with the evidence to prove it.
- Discoverevery device
- Enrolan agent on each
- Patchand prove it
Your fleet60 devices, sample data
Unknown18
Agent coverage47%
Fully patched20%
The problem
Exposure hides in three places
Most unpatched systems aren't ignored. They just never made it into anyone's view.
Unmanaged
Devices that are known but not reporting: no agent, or an agent that went quiet. The register says they exist. It can't say what state they're in.
Unpatched
Updates that are available but not applied, because nobody sees the fleet-wide picture or nobody dares roll them out without a safe way to do it.
How it slips through
Six gaps, and how each one is closed
Devices nobody recorded
How it slips throughLaptops, servers and network gear arrive through projects, vendors and hurried installs. If it never reached the register, it never gets patched.
Closed withDiscovery by IP range, subnet, Active Directory, LDAP, SNMP, WMI, PowerShell, SSH, CSV and Unified360, on a schedule, into a review queue with duplicate checks.
Agents that never got installed
How it slips throughA device that is on the network but has no agent reports nothing, so it looks fine while it is not.
Closed withPre-configured agent installers, agent push over WinRM to discovered Windows devices, and an Agent Coverage view: Active, Stale and Not installed.
Machines gone quiet
How it slips throughAn agent that stopped reporting weeks ago is still a healthy-looking row in the register.
Closed withAgents send heartbeats, devices show as online or offline, and connectivity counts toward the compliance score, so silence pulls the score down.
Missing updates nobody sees
How it slips throughPatch status lives in each machine's own update settings. Nobody sees the whole fleet.
Closed withAgents scan for pending updates, Windows Update on Windows and apt on Debian and Ubuntu. Missing patches are listed per device, with the most common ones across the fleet.
Rollouts that break things
How it slips throughA patch pushed to everyone at once, or a reboot in the middle of the working day.
Closed withPolicies with scope, schedule, maintenance window and four reboot modes, staged rings with a failure threshold that halts a bad rollout, and fleet-wide decline for a bad patch.
No proof for the auditor
How it slips throughThe patching happened, but the evidence is scattered across consoles and inboxes.
Closed withPatch Compliance Summary, Critical Vulnerability Exposure and Patch Deployment Change Log reports, mapped to ISO/IEC 27001 Annex A control 8.8 and exported as one evidence bundle.
How IntelliAsset closes them
Discover. Enrol. Patch. Prove.
Four steps on one platform, from the device nobody recorded to the report an auditor can read.
Step 1 · Discover
Find what nobody recorded
- Scan IP ranges and subnets, query Active Directory, LDAP, SNMP, WMI, PowerShell and SSH targets, or import what Unified360 already monitors.
- Run discovery on a schedule, so new devices surface without anyone asking.
- Every find lands in a review queue. Onboarding checks hostname, MAC and IP against existing assets, so duplicates are stopped.
Step 2 · Enrol
Turn devices into reporting devices
- Download an agent already configured with your server and enrolment token: double-click on Windows, one command on Linux and macOS.
- Push the agent to discovered Windows devices over WinRM, using the credential that found them.
- Agent Coverage shows Active, Stale and Not installed, so a gap is a number rather than a hunch.
Agent Coverage · IT assetsHow much of the fleet is actually reporting in
Active 28Stale 5Not installed 27
Two ways to close the gap
Download a pre-configured agentPush over WinRM to a discovered Windows device
Step 3 · Patch
See it. Approve it. Roll it out.
- Agents scan for pending updates: Windows through Windows Update, Debian and Ubuntu through apt. Missing patches are listed per device.
- A scan that fails never reads as “nothing missing”. The last known state is kept instead.
- Policies set scope, schedule, maintenance window, reboot behaviour and approval, and rollouts can run in rings.
Step 4 · Prove
Show the score and the evidence
- A compliance score per device blends patch state, connectivity, lifecycle and condition.
- Agent Coverage and the most common missing patches sit on the same page.
- The ISMS audit pack maps 29 reports to ISO/IEC 27001:2022 Annex A, including patch reports for control 8.8.
Patch without the roulette
Try a staged rollout
Pick how devices restart, run the rollout, and break it on purpose to see the failure threshold stop it before it spreads.
Sample patch policy
Monthly Windows security updates
Scope: Finance departmentWindow: Sat 22:00 to 04:00Approval requiredHalt above 10% failures
Rollout
Ring 1 · Test group0 of 5
Ring 2 · Broad rollout0 of 55
Illustrative. Rings, wait times, thresholds and reboot modes are set per deployment or policy. Sample data.
8Scan methods
3Agent platforms
4Reboot modes
29Annex A audit reports
Proof, not effort
A score for every device, and the evidence for the audit
Each device gets a compliance score from patch state, connectivity, lifecycle and condition.
Compliant · 90 and upAt risk · 70 to 89Non-compliant · below 70
- Patch reports built for auditorsPatch Compliance Summary, Critical Vulnerability Exposure and Patch Deployment Change Log, mapped to Annex A control 8.8.
- One evidence bundleExport the reports you choose as a PDF each, with a manifest listing the controls they cover.
What changes
When nothing hides and nothing lingers
A register you can trust
Discovery, review and duplicate checks keep the record of what exists close to what is really there.
Coverage you can measure
Active, Stale and Not installed turn “are we covered?” into a number you can improve.
Patches on your terms
Scope, schedule, windows, reboot modes and staged rings let you patch without surprising anyone.
Evidence on demand
Patch and asset reports mapped to Annex A are one export away, not one week away.
Built with
The platforms behind this solution
IntelliAsset
IT asset and patch management
Discovery, agents, patch policies and rollouts, compliance scoring and audit-ready reporting in one self-hosted platform.
Unified360
IT operations and observability
IntelliAsset can import the network devices, servers and desktops Unified360 already monitors as a discovery source.
Questions
Frequently asked
Do we need an agent on every device?
No, but patching needs one. Discovery records devices without an agent, including network gear found over SNMP and anything an IP scan or directory query can see. To scan for and install patches on a device, it needs the agent.
Which systems can it patch?
Patch scanning and installation cover Windows, through Windows Update, and Debian and Ubuntu Linux, through apt. The agent also runs on macOS and RPM-based Linux for inventory, but patching those is not covered today.
What if a patch breaks something?
Roll out in rings so a small test group goes first. Set a failure threshold and the rollout halts before it reaches the wider fleet. You can also decline a patch fleet-wide with a reason, and it will be blocked from deployments. A rollback is recorded per device with the reason and an audit entry; it does not itself uninstall the update.
Will devices restart in the middle of the working day?
Only if you choose that. Each policy has a reboot mode: suppress, force, prompt or window. With window, restarts happen only inside the hours you set.
Do patches install without approval?
Policies can be set to auto-approve, and that option is off by default. Otherwise a deployment is created and run under your control, with per-device status.
How does discovery avoid duplicate assets?
Discovered devices go to a review queue first. When you onboard one, IntelliAsset checks hostname, MAC and IP against the existing assets and stops a duplicate.
Does it show CVEs and severities?
It tracks missing updates by their KB or package identifier, with a severity held in the patch catalog, and that severity is often Unknown until it is classified. Correlating installed software with CVEs through SBOMs is on the roadmap.
Can it run in our own environment?
Yes. IntelliAsset is self-hosted with a Docker-based install, so inventory, documents and evidence stay inside your network. Agents enrol themselves against your server.
See it on your own estate
Find out what you're not patching
Tell us about your environment and we'll show you IntelliAsset finding and patching it. No commitment required.