Unified Asset Inventory
One view of every host, container, and serverless function across AWS, Azure, GCP, and on-prem. Assets are automatically tagged by environment (prod/staging/dev), business unit, and criticality tier based on your tagging convention.
Supports AWS EC2, EKS, Lambda; Azure VMs, AKS, Functions; GCP Compute, GKE; VMware vCenter 6.7+; bare-metal via SSH.
PatchScore™ Engine
Our scoring model goes beyond CVSS. It weights each finding by whether a public exploit exists (PoC or weaponized), whether the asset is internet-facing, and whether your industry is an active target in current threat intel feeds.
Pulls exploit availability from ExploitDB, Metasploit modules index, and CISA KEV. Refreshes every 4 hours.
Patch Policy Engine
Define policies per asset group: which severity tiers auto-deploy, which require approval, what the maintenance window is, and what the canary rollout percentage is. Policies are version-controlled and auditable.
Policies defined in YAML, stored in your Git repo. Changes trigger a policy validation run before activation.
Rollback Engine
Before every patch deployment, PatchGuard takes a package snapshot and records the current process health baseline. If CPU, memory, error rate, or uptime crosses a configurable threshold post-patch, automatic rollback initiates within 90 seconds.
Rollback success rate: 99.7% across 12,000 deployments in production environments to date.
ITSM Integration
Every high-severity finding creates a ticket in Jira or ServiceNow with pre-populated fields: CVE ID, CVSS score, PatchScore, affected assets, and a one-click approve button that triggers the patch pipeline directly from the ticket.
Jira Cloud, Jira Server 8+, ServiceNow Paris release and later. Webhook delivery <5 seconds.
Access Control
Role-based access with four built-in roles: Viewer, Analyst, Approver, and Admin. SSO via SAML 2.0 (Okta, Azure AD, Google Workspace). All actions are logged with the authenticated identity and session token hash.
MFA required for Approver and Admin roles. Audit log exports available on demand.
