Patch management
Patch management software that prioritizes real risk
trio.so finds every missing update and open CVE on Windows, macOS, Linux, iOS/iPadOS and Android, ranks them by how likely they are to be exploited, and patches the operating system and your third party apps on a schedule you control. One console, no scripts.
trio.soHarbor & PinePatch & Vulnerability ›FindingsFindings
Confirmed CVE matches across enrolled devices. Open a finding to review its devices and record a decision.
Manual patching can't keep up
Hundreds of CVEs, no order
New vulnerabilities land every week. A severity score alone can't tell you which ones attackers are using right now, so the queue gets worked top to bottom and the real risk waits.
One tool per operating system
WSUS for Windows, a script for the Macs, nothing for Linux or phones. Each tool has its own report, and none of them agree on what is actually patched.
Apps fall behind the OS
Browsers, PDF readers and meeting apps carry many of the flaws attackers go after, and Windows Update never touches them.
How it works
How patch management works in trio.so
Patching shouldn't need a dedicated admin or a project plan. trio.so does the finding and the ranking, you decide what goes out and when, and the record keeps itself.
- FindThe trio.so agent reports installed software and missing updates from every device. Each finding is matched to its CVE, so you see exposure per device and per vulnerability, across every operating system, in one list.
- RankEvery CVE gets a risk score from 0 to 100 built from its CVSS severity, its EPSS probability of exploitation, how critical the device is and how exposed it is. Anything on the CISA known exploited list stays near the top. The worst ones rise on their own.
- PatchPick a finding and trio.so builds one plan per platform from the right source: a package in your patch repository, the software catalog, or the device's own package manager on Linux. Run it now or schedule it, and choose how devices restart.
- ProveSchedule reports daily, weekly, monthly or quarterly, including one for known exploited vulnerabilities only, or export a report to CSV or Excel. What was found, what was fixed and when is already written down.
Prioritization
Prioritize vulnerabilities by real risk
A critical CVSS score on a flaw nobody exploits matters less than a medium one that ransomware crews use every day. trio.so scores both, so your team patches in the order that actually reduces risk.
- Exploit likelihood, not just severityEPSS estimates how likely a CVE is to be exploited in the next 30 days. trio.so shows it beside the CVSS score for every finding.
- Known exploited flaws firstCVEs on the CISA known exploited vulnerabilities list are flagged, and a minimum score keeps them from sinking down the queue.
- A score you can explainThe weights behind every score, CVSS, EPSS, asset criticality and exposure, and the bands from low to critical are right there in settings. No black box.
Third party apps
Patch third party apps, not just the OS
Most of what users run every day isn't made by Microsoft or Apple. trio.so patches the browsers, readers and tools on your devices with the same plans and the same reports as the OS.
- A catalog of common business appsPick common business apps, like browsers, PDF readers and meeting tools, from the software catalog and keep them current without packaging anything yourself.
- Your own packagesUpload an installer for in house or niche software to the patch repository. trio.so links each package to the CVEs it fixes, so it shows up as a patch option on those findings.
- Linux packages through apt or dnfLinux plans upgrade the affected package through the device's own package manager, so Linux machines get patched from the same finding as your Windows and Mac fleet.
- Automatic fixes by severitySwitch on automatic fixes for critical and high findings, or any severity you choose. When a published package is linked to the CVE, trio.so creates the patch plan by itself.
Every OS
Automatic updates for every operating system
Set an update policy once per platform, so routine OS updates install on their own and your team only handles the exceptions.
- Windows and macOS patch managementWindows updates install automatically, with control over metered connections and optional content. macOS updates install with notifications and a set delay before major upgrades.
- iOS/iPadOS and Android updatesHold major iOS/iPadOS upgrades for a set number of days, and install Android system updates inside a time window you choose, so phones update when nobody is using them.
- Linux and third party patchingLinux packages upgrade through apt or dnf patch plans, and third party apps can fix themselves by severity as soon as a published package is linked to the CVE.
See your patch backlog in a free trial
Start a free trial, enroll a few devices, and the findings list fills in from your own fleet. No credit card, no sales call needed.
Reporting
Patch reporting and SLA tracking
Set deadlines for each severity and trio.so tracks every finding against them. When someone asks how exposed you are, you open a page instead of building a spreadsheet.
- Deadlines by severitySet acknowledge and fix deadlines per severity, then filter findings by SLA state to see what is late.
- Known exploited reportA scheduled report of only the CVEs attackers are already using.
- Scheduled reportsDaily, weekly, monthly or quarterly, or run any report on demand.
- Accepted risk, on the recordWhen a fix isn't possible, record the decision on the finding instead of leaving it open.
- Audit trail exportExport who changed what, and when, as CSV or JSON.
- Alerts where you workSend patch alerts to email, Slack or Microsoft Teams.
Features
More patch management features
Small controls that keep a patch from becoming an outage.
Zero day view
A dedicated view for the flaw everyone is talking about this morning.
Critical now filter
One click shows what needs attention right now.
Restart control
Choose how devices restart for every plan.
Major upgrade delays
Hold major macOS and iOS/iPadOS upgrades for as many days as you need.
Metered network control
Keep Windows updates off metered connections.
Per device view
Open any device to see its open CVEs and their status.
Why trio.so
Patching in the same console as your devices
Most teams add a patch tool next to their MDM, their RMM and their compliance spreadsheet. trio.so puts patching in the same console as the devices themselves.
One console for the whole device
Patches, configuration, compliance, remote access and inventory share one device record, so nothing gets lost between tools.
Pricing you can read
Plans start at $5 per device. Patch and vulnerability management is in the Secure plan and above.
Rated 4.8 on G2
IT teams rate trio.so 4.8 out of 5 on G2, with support from real people 24 hours a day, Monday to Friday.
Related