QUME · Patch and vulnerability
Patch management that proves the fix landed
A finding does not close because a command succeeded. The installer can roll back, the reboot can be declined, the vulnerable file can still be on disk beside the new one. QUME closes a finding only on evidence from the device.
Gate OPEN All three conditions hold, so the next ring may start.
- A wave installs across the estate in rings, a small canary first and then larger groups, with a gate between each pair.
- A gate has three conditions and all must hold: enough devices have reported, the soak has elapsed, and the failure rate among those reports is under the threshold.
- A device that never answered is unreachable, not failed. It blocks the gate rather than halting the wave or letting it complete against devices that never received it.
Capabilities
What QUME does for patch and vulnerability
Inventory-driven identification
Software is normalised, identified against CVE and CPE data and vendor bulletins, configuration-only findings are treated as first class, and the result is ranked into a remediation queue for each organisation.
Confirmation from the device itself
Every finding a scan opens is put back to the endpoint: is this package really here, at this version, now? A refuted finding closes as not applicable, never as fixed.
Verification on a later inventory
Remediation is verified by a version observed on the device afterwards. A patch that did not take shows as still vulnerable instead of disappearing.
Bounded, reasoned risk acceptance
An acceptance needs an expiry, a reason and the right permission. An acceptance with no end date is a deletion in disguise.
Content-defined chunking and branch caches
Payloads split on content, so a rebuilt binary re-sends only what changed. Measured on two real service binaries weeks apart: 18.08% reuse, against none for fixed-size splitting.
An estimate in WAN bytes, before you commit
900 devices at one branch each needing 4 GB is 3.6 TB of transfer, and 4 GB of WAN if the branch caches it. The wizard ends on that number and names every device it could not place.
In the console
And in day-to-day use
Operating system and third-party patches
One patch store for operating system updates and third-party applications, with your approval rules and scanners.
Software catalogue and self-service
A signed application catalogue, a self-service portal, prohibited software and automatic updates.
Air-gapped delivery
A signed content repository that reaches isolated networks by offline bundle, with the same verification.
Questions
What buyers ask
When does QUME call a vulnerability fixed?
Only when a later inventory from the device shows the fixed version. A successful install command alone is not enough.
What if a patch causes problems?
Rollouts run in rings. A ring gate halts the wave when failures cross the threshold, and a person decides what happens next.
See patch and vulnerability in QUME
On your own devices, with your team.