How Senserva Patches

Coming Soon

Patent Pending

Too many patches are still applied by hand, while AI-driven attacks move faster than any manual process. Senserva's goal: make patching faster, easier and much more reliable, by closing the three gaps today's tools leave: machines they never see, patches too hard to install, and bad patches found too late.

This page shows how Senserva 360 Patch+ patches a Windows PC in each kind of environment: with nothing managing its updates, with WSUS, with Intune, Windows Update for Business or Windows Autopatch, with Configuration Manager, and beside a third-party patcher such as Patch My PC. Each section says what Patch+ does, what it leaves to the tool you already run, what that tool leaves open, and why.

Get notified Free alerts: Senserva Watch Exploited this week

Patch+ is coming soon. What you can use from Senserva today is below, with a link to each.

Why patching cannot wait

CISA "maintains the authoritative source of vulnerabilities that have been exploited in the wild" and says organizations "should use the KEV catalog as an input to their vulnerability management prioritization framework."CISA, Known Exploited Vulnerabilities Catalog

Every environment below leaves at least one of the three gaps open. Each section names it. While Patch+ is coming, these are live on senserva.com now.

What you can use from Senserva today

Senserva Watch

Free alerts for Microsoft admins: the Patch Tuesday wire on release day, CISA KEV adds on CVEs you follow, changes on KBs you track.

Join Senserva Watch

Exploited this week

The CVEs added to the CISA KEV catalog in the last 7 days, with CVSS, EPSS, ransomware use, and the Senserva AI read on each.

See this week

Microsoft patch tracker

Microsoft security updates ranked by real exploitation (CISA KEV, EPSS), free and updated twice a day.

Open the tracker

Siemserva, available today

On the Microsoft Security Store. Senserva reads your Microsoft 365, Intune, Defender, and Entra ID environment: every update still missing, on every device, ranked by what attackers are actually exploiting. Deploying stays in the tools you already run.

AI Patch Management in Siemserva

Patch+ is coming soon

Get on the notification list and hear when Senserva 360 Patch+ ships.

Get notified

One scan, the same in every environment

Patch+ decides what is missing the same way everywhere. What changes from one environment to the next is who installs, and that is what the sections below are about.

Senserva patch datarebuilt every day
Patch+ scanversions on disk
Missing updatesexploited first
Problem patchesmarked Warning
Third-party appsPatch It installs
Microsoft updatesleft to Windows Update

The same scan runs in every environment. Patch It installs third-party app updates; Microsoft's own updates stay with Windows Update.

The disk decides: The scanner judges what is really on disk: file, registry, package and app versions, not a log that says an update ran. For a Windows cumulative update it reads the build Windows reports, CurrentBuild and UBR, not a file's version.
Exploited first: CISA's Known Exploited Vulnerabilities catalog and FIRST EPSS exploit likelihood put urgent patches at the top.
Problem patches flagged: A patch with a Microsoft known issue or a Senserva Watch breakage alert is marked Warning in the report, with Microsoft's status and fix. With Patch It, such a patch is held from installing until you override it by name.
Live patch data: Senserva's patch repository is rebuilt every day from vendor and threat sources. Hosted patch data, with registration.
Nothing unread counts as clean: A source the scan could not read is listed as not checked. A PC whose Windows version could not be read is partly checked, never up to date.
Why: Accuracy comes first. A report that says installed while the disk says otherwise leaves the hole open and hides it.

A PC nothing manages

No WSUS, no Intune, no Group Policy for updates and no Configuration Manager: a home PC, or a machine in a small office.

Patch+ scanthis PC, exploited first
Patch Itverified installers, one administrator prompt
Windows UpdateMicrosoft's updates
Rescanproves the result
Restartonly when you choose

On a PC nothing manages, Patch It installs the missing app updates and a rescan proves them. Microsoft's updates stay with Windows Update.

What Patch+ does: Patch It installs the missing third-party app updates with Senserva's verified installers, after one administrator prompt. It first checks why updates fail on this machine, and it never restarts on its own. A rescan proves the result. When an update needs a restart, Patch+ asks before it restarts: restart now, tonight, or delay an hour, up to three times. Where no policy sets an update deadline, you can set one in Patch+; on Windows Pro, Enterprise and Education it also writes Windows' own deadline setting, and on Windows Home it stays a Patch+ setting.
What it leaves to Windows Update: Microsoft's own updates stay with Windows Update.
What Windows Update leaves open: Windows Update does not cover third-party apps such as Acrobat Reader, Zoom or 7-Zip. On a PC nothing manages, each of those apps depends on its own updater.
Why: Third-party apps are what Windows Update does not cover, so that is where Patch It installs. Restarts wait for the person at the PC, who knows whether now is a good time.

A PC managed by WSUS

"Windows Server Update Services (WSUS) provides a way for IT administrators to deploy the latest Microsoft product updates."Microsoft, WSUS overview

WSUSthe administrator approves Microsoft updates
Windows Updateinstalls what was approved
Patch+ scanwhat is missing on disk
Reportevery missing update, exploited first
Patch Itthird-party apps

WSUS keeps the decision on Microsoft updates. Patch+ reports what is missing, approved or not, and installs the app updates WSUS does not carry.

What Patch+ does: The scan reports every update missing from the disk, Microsoft and third-party, exploited first, whether or not WSUS has approved it yet. Patch It installs the missing third-party app updates.
What it leaves to WSUS: Which Microsoft updates install, and when. Patch It does not install Microsoft's updates, and Patch+ writes no Windows Update policy on a PC whose Group Policy names an update server. WSUS approves updates but does not schedule restarts, so when an app update needs a restart Patch+ still asks first, unless Group Policy has Windows Update install on a schedule; then restarts stay with Windows Update.
What WSUS leaves open: WSUS offers a PC only the updates its administrator approved, so a fix for an exploited vulnerability waits until someone approves it. Third-party apps reach WSUS only through a publishing tool.
Why: An approval in WSUS is the administrator's decision, and Patch+ does not override it. What Patch+ adds is the evidence for that decision: the exploited fixes still missing from the disk, at the top of the list.

Intune, Windows Update for Business or Windows Autopatch

Update rings, deferrals and deadlines, set through Intune, Windows Autopatch or Group Policy.

Intune or Group Policyrings, deferrals, deadlines
Windows Updatefollows the ring, restarts by policy
Patch+reads the policy and the disk, shows each deadline and its source
Patch Itthird-party apps

The policy keeps Microsoft's updates, the deadline and the restart. Patch+ reads them, shows where each came from, and installs only app updates.

What Patch+ does: Patch+ reads the update policy on the PC. When Intune, Group Policy or Configuration Manager manages restarts, Patch+ leaves them to it, and shows the deadline and where it came from. The scan still reports every missing update, exploited first, and Patch It installs the missing third-party app updates.
What it leaves to the policy: Microsoft's updates, the ring, the deferral, the deadline and the restart. A value set by policy is shown read-only, and Patch+ writes no Windows Update policy on a managed PC.
What the policy leaves open: A policy decides when an update is offered; the disk says whether it is installed. And a PC that is not enrolled is one of the machines a tool never sees. Patch+ can also scan your network or your domain, with nothing to install on the machines it scans.
Why: Two restart schedulers on one PC are worse than none. When another manager owns restarts, Patch+ restarts nothing and says who does.

Running Intune today? Siemserva reads patch state from Microsoft Defender for Endpoint and Azure Update Manager. Deploying stays in the tools you already run.

Configuration Manager (SCCM)

A PC with the Configuration Manager client installed.

Patch+ scanfinds the client
Configuration Managerdeployments and restarts
Microsoft updateson its schedule
Reportexploited first
Patch Itthird-party apps

Patch+ finds the Configuration Manager client and leaves restarts and Windows Update to it. It reports what is missing and installs only app updates.

What Patch+ does: Patch+ recognizes the Configuration Manager client on the PC and treats Configuration Manager as the manager of restarts and Windows Update: it offers no restart choices there and writes no Windows Update policy. The scan reports what is missing, exploited first, and Patch It installs the missing third-party app updates. The p25 command-line scanner can be deployed through Intune, Group Policy or Configuration Manager, with JSON output.
What it leaves to Configuration Manager: Microsoft's updates, their deployment schedule, and every restart.
What Configuration Manager leaves open: A deployment installs what someone added to it. An app nobody added, or a fix that has not been deployed yet, stays missing until the disk is checked.
Why: The deployment schedule is the administrator's plan. Patch+ reports against it and leaves it in place.

Beside Patch My PC, or another third-party patcher

Patch My PC is a third-party application catalog and update publisher for the Microsoft management stack: it publishes apps and updates into Microsoft Intune, Configuration Manager, or WSUS.

Patch My PCpackages app updates
Intune, Configuration Manager or WSUS
The PC's installed versions
Patch+ scanthe same disk
Already currentnothing to install
Still missingexploited first, problem patches marked

Patch My PC publishes and your management tool deploys. Patch+ reads the result on the disk: what landed reads as current, what did not is ranked.

What Patch+ does: Patch+ patches every computer, not only the ones a Microsoft management tool manages: a PC nobody enrolled in Intune, a home-office laptop, a server outside the domain. On a PC Patch My PC already serves, Patch+ reads the installed versions from the same disk, so an app it already updated reads as current and Patch It has nothing to install for it. Whatever is still missing is installed, exploited first, with problem patches marked Warning.
Where Patch My PC stops: Patch My PC publishes into Intune, Configuration Manager or WSUS, so it reaches only the PCs those tools manage, and only the products in its catalog. Patch+ needs neither: it is not limited to a management tool, and it is not limited to their catalog.
What a publisher leaves open: A publisher knows what it published and deployed. Whether each update is on each disk, and which missing ones are being exploited, is a different question.
Why we complement it: Where Patch My PC runs, Patch+ fills the gaps and proves the result. Where it does not run, Patch+ is the patcher.

Using Patch My PC with Intune today? Siemserva reads apps published to Intune by PatchMyPC, Scappman, Robopack or any Win32 vendor, vendor-neutrally. See Senserva and PatchMyPC compared.

The principles behind it

Accuracy first

The verdict comes from the disk, every warning names its source, and a check that could not run is listed as not checked, never as clean.

Never fight the administrator's tool

Where WSUS, Intune, Group Policy or Configuration Manager decides, Patch+ reports and leaves the decision there.

Consent

Nothing installs until a person consents: each one, or once by opting into scheduled patching. Patch It asks for administrator permission once, and never restarts on its own.

AI-enhanced, not AI-dependent

Every scan and install works without AI; the agents make it better.

Built by a team led by Mark Shavlik

Mark Shavlik is CEO and CTO of Senserva. A former member of the Microsoft Windows NT Kernel team, Mark created HFNetChk and MBSA for Microsoft, and his team built the SMS 2.0 SUS Feature Pack. Mark and his team developed core patch management technologies that were later used in Windows Server Update Services (WSUS). He founded Shavlik Technologies, one of the industry's leading patch management companies, and sold it to VMware; the patch model he designed is still in use in many major patching products.

Senserva is all-new technology, built by Senserva. It shares no code or products with Shavlik Technologies, which Mark sold to VMware. HFNetChk, MBSA, SMS and WSUS are Microsoft products; HFNetChk was developed by Shavlik Technologies and distributed by Microsoft. Other names are trademarks of their owners.