Patch window coordination

Sequences reboots so the same host is patched once, in dependency order, without a maintenance page.

macOS — coming soonSee the 4 automations
IT / AUTOMATE.md

Every weekday at 7:30am, list the devices past the patch window with the days overdue, and assign each one to the owning team with a restart date.

Ready-made: Patch Compliance Report

The job, and what good looks like.

Patching is scheduled per team, so a server gets restarted twice in one night and a domain controller is patched after the machines that depend on it. The hosts that need a restart are the ones nobody owns, so they sit unpatched for weeks while the report still says the patch was deployed. The workflow builds the window. It reads the list of hosts that are past their patch deadline, separates the ones that can patch while running from the ones that need a restart, and orders the rest by dependency rather than by whichever team replied first. Domain controllers and file servers go first, application servers next, workstations last. Each batch gets an owner, a time and a confirmation step, and a host already restarted that night is not queued again. The window closes with a coverage report by business unit instead of a percentage of the fleet, so the gap is named. A human approves the window, the order, and any host that will be left out of it.

When it is handled

  • Reboot backlog at zero each week
  • Dependency order respected in every window
  • Patch coverage reported per business unit

Works with tools like

  • Microsoft Intune
  • Jamf
  • Qualys
  • ServiceNow Security Operations

Ready-made automations. Pick the one that fits.

Each one is a plain-language document. Run it as it is, or change the timing, the rules and the tools to match your team.

Emergency Patch Rollout

When a vulnerability is exploited in the wild, list the exposed systems, push the patch through device management, and report which hosts are done and which need hands.

When an actively exploited vulnerability affects an internet-facing system

Mac Reboot Queue

Every Friday at 4pm, list the Macs waiting on a restart by site and criticality, then post the order for the change window and who is covering it.

Every Friday at 4:00pm

Patch Compliance Report

Every weekday at 7:30am, list the devices past the patch window with the days overdue, and assign each one to the owning team with a restart date.

Every weekday at 7:30am

Patch Dependency Order

When a patch window opens, pull the fleet list and write the restart order so domain controllers go first and workstations last, with an owner named per batch.

When a patch window is opened for a server fleet

You stay in charge.
At every step.

It triages and sweeps. People approve every change.

  • No change without approval

    Blocking, revoking and purging wait for an analyst's OK.

  • Every run on the record

    What it read, what it did and what it is waiting on, kept for review and audit.

  • Scoped per automation

    Each automation gets only the access you grant it, and a local model can keep processing on your machine.

Patch Compliance Report

Approve before it files the ticket?

ReviewApprove

Before you download.

Where does it run?
On your Mac or Windows computer, in the background. It keeps working after you close its window, and only reaches the folders and apps you connect for each automation.
How does it connect to our CRM and other tools?
Through each app's own connection where it offers one, signed in once by you, or by using the app in a browser the way you would. Each automation gets only the connections you give it, and the tools a page names are examples you can swap for your own.
Does it run when my computer is asleep?
It keeps your computer awake while a job runs and just before a scheduled one. While the computer is closed or off, nothing runs; when it wakes, it checks the inbox, calendar and other sources it watches for anything that arrived meanwhile.
How does my team use it?
Each person who runs automations installs the app. Keep a project in a shared folder, such as Google Drive or a network drive, and teammates can open it and follow every run, while one person owns it and runs it.
Do I need anyone technical to set it up?
No. Download the app, add an automation in plain words, and connect only what that job needs. Nothing runs until you switch it on.

Already have tools for this? Here is the difference.

Scripts and scheduled jobs

Precise, repeatable system tasks.

They break on the unexpected, and only their author can read or change them.

Security automation platforms

High-volume response playbooks in large teams.

They need a project to set up and an engineer to maintain each playbook.

AI chat assistants

Explaining an alert when you paste it in.

Nothing runs on schedule, and there is no scoped access or record of what was done.

AUTOMATE.md

Your routine, written in plain words. It runs on its own, follows your rules, handles the exceptions a flowchart can't, and asks you when it matters. The file stays yours, whichever AI model runs it.

Related workflows.

Vulnerability SLA tracking

Assigns every open finding an owner and a deadline, and escalates only the ones about to breach.

4 automations

Vulnerability reports

Builds the periodic report from the scanners themselves, so every open finding carries an owner, a deadline and a visible status.

Write your own

Backup verification

Restores a real file and a real service on a schedule, so a green job status stops standing in for a proven recovery.

Write your own

Start with one job.
Make it your own.

macOS — coming soon
  1. 1

    Get the app

    It runs on your computer, next to your files.

  2. 2

    Add the automation

    Paste the instructions into the app, or save them as a file next to your work.

  3. 3

    Try it, then turn it on

    Run it once and check the result. It only runs on its own once you switch it on.

macOS — coming soon