Transcript
accelerated vulnerability and patch management. We're going to talk about some cool stuff today. And if you haven't had a chance to play around new patch, new bone security inflates, I'm going to show you how to do that today. Alright, cool. So what I'm going to do here is a little legal disclaimer that I have to do for every webinar only because I do talk about things that are coming down the road. And unfortunately, I don't get to make product and plans around or decisions around product plans. So this content may contain forward looking statements regarding future product plans and development efforts, so on so forth. What that basically means is, again, if something comes up, you know, we need to rejig the roadmap, whatever I'm telling you, cannot be taken as verbatim, because product plans do change. All right. Who am I? If you haven't met me before, I do encourage you to come to empower and see me face to face. But if you haven't met me, my name is Jason Murphy. I'm one of eight head nerds here at Enable. I primarily dabble in the IT operations space here at Enable. But I also, you know, kind of dabble in a little bit of everything. So kicking around Enable, either as a partner or as a, uh, uh, an employee, uh, for the last almost, I think it's 14 years almost. So maybe it's, maybe it's 12. I can't remember. Um, but it's been a while. Uh, so, you know, uh, what do I do? You know, I work with you, our partners on improvements, uh, making sure that your business is running optimally. Um, I, I craft automation. Um, I work with our product team. So I report to our, actually I report to our CTO now through Marc Andre. Um, so, uh, that's a new development here at Enable. Uh, so we're, uh, reporting directly directly to, uh, Mike Adler, who was our chief product officer, uh, and CTO. Um, so that's me in a nutshell. Um, you can find me online. Now, what we're going to do is get started with the agenda. Okay. And then we're going to go right into a poll because I want to understand, uh, your train of thought. So we're going to talk about why the old patch cadence, uh, has not, is no longer working. Okay. So I'm going to flip the script a little bit. Uh, what just released the closed loop prioritize by real risk. And then we're going to talk ask Enzo reach and control. I'm going to do a live demo and then we'll do a Q and A at the end. It should be about 45 to an hour. Okay. So let me find the poll section here because I'm going to ask you how much time do you think you have before a CDE is exploited? Is that two hours, four hours, six hours, or eight hours? Don't Google it. Just put in your answer. Oh, I'm going to give you the statistic from 2025. Okay. Um, because obviously we're not at the end of 2026. Okay. So I'm going to end that poll and I'm going to share the results. Okay. So 64% of you said two hours, 27, four hours, 4%, six hours, and another 5%, eight hours. Okay. I'm going to close that poll because we're going to talk about the reality and the hours to exploit is actually in 2025 is, um, four hours. What I can tell you now is the belief is we're now in negative hours to exploit. And the reason being is attackers are actually grabbing patches, um, and reverse engineering them, probably using AI, um, and then able to formulate, uh, the exploit. Um, in 2025, there were 48,185 CDEs. Okay. So one in every six CDEs ever published landed in one single year. Okay. So things are drastically different. The landscape has changed. I want you all to know this because, um, I spend my life in these, this kind of data, you know, trying to help you, our partners, um, be able to manage this catastrophe. Okay. The defender, you and I, um, typically patch in a 30 day cycle. Um, that actually has to change, unfortunately. Um, so if you're on this call and I do challenge you because we're, uh, close to 150 of you on this call is that, um, you can no longer patch in a monthly cycle. Okay. What do you do? Well, maybe you have to patch daily, weekly, but it cannot be monthly. Okay. Uh, only because you have to protect yourselves and of course, uh, either your employees or, uh, your customers. And that is just how it is going to be moving forward. Uh, patch management is everything, uh, when it comes to managing your customers and protecting them or your employees as well. Okay. So that basically means that's 29 days, 20 hours of known unpatched exposure. Now I have partners, I go into, uh, people's insight or in central just about every single day. Um, and I see how you configure patch management. Um, and as a it operations kind of person, um, the thought was I need to mitigate downtime, right? It's a kind of a risk when you patch because patches can break things and then that can cause you sometimes headaches, right? So, and of course my phone's going off. We'll get rid of that one sec. There we go. Um, so again, attackers are increasingly reverse engineering the fix itself. The patch is the exploit roadmap and it's the public for most teams have and it's public before most teams even have, uh, deployed. Okay. Now the gap that the attackers live in. Okay. Same CVE, two different clocks. Okay. It's you versus them. Okay. Red team, blue team. All right. The attacker, a working exploit is circulating, sometimes reverse engineered from the patch itself. Days mass scanning begins for hosts that have not patched. Again, that has to change. You have to do detections sometimes hourly. I wouldn't say every hour. Uh, but you know, when you're talking about humans in front of laptops and workstations, you typically have to do that several times during the day because you're actually keeping your RMM in the now, um, about what patches are available. And again, you know, I've been doing this patch management thing for well over 20 plus years now. Um, I used to patch monthly, you know, I used to stay up even before, you know, RMMs, I used to stay up in the middle of the night and try to, you know, patch servers from, you know, 8 p.m. Sometimes a little 4 a.m. That was part of my job. Okay. So we need to figure out how to do this. Your team. Okay. The CV sits unranked in a queue alongside hundreds, thousands of others. You're using probably some kind of vulnerability tool that is, you know, launched sometimes weekly, maybe monthly or even quarterly to understand your exposure or your customer's exposure. Oftentimes you're using this as a professional service with your customers, right? Triage testing and change approval. If it gets picked up at all. And the next maintenance window, if the reboot actually happens. Now, I will also challenge you in terms of your thought process, because oftentimes people do believe that installing a patch completes the, um, the patch life cycle. And then we wait for end users to, or we ask them to reboot their own computers. Um, again, when it comes to compliancy, you may have to rework that with your customers. It has to be compartnered for, for MSPs on the call. Um, it actually has to be part of your, um, MSA. It's called your maintenance services agreement is that you have to reboot your customer in days after a patch. And if you can work it same day, if you, if possible, now habits built for a world that this is very lofty, but, um, what I tell you is, again, I go into partners and central servers. So if this doesn't apply to you, don't try, try to understand. I tend to get a little preachy around how you should operate. Um, it is my belief. It doesn't have to happen for every single one of your customers. But again, we need to change, uh, how we're thinking about patch management. So I have partners that are trying to patch their customers at 2am. That's all they do. And sometimes it works. Sometimes it doesn't laptops powered off, you know, it's, it's not getting patched. Okay. And then maybe the customer in a week or two patches, their own device or Microsoft force or whatever. Um, you can't patch your customer at 2am. Um, typically, um, unless you're working manufacturing environments or what have you, um, you know, there are always on devices. So that's great. Um, but when it comes to end users sitting behind these laptops, the lid gets closed and the power goes off. And unless you've configured the device for things like wake on land, which most people don't is that it doesn't patch. Okay. So you have to use those, uh, sometimes those daytime life cycles to get things completed. Okay. Install now reboot later. It is not patched unless it's rebooted in most cases. Sometimes there are patches that are actually fully installed without having to reboot it's few and far between these days, especially when it comes to security updates, Microsoft updates are the patch program. Nope. Microsoft is the important piece here because the majority of your fleet is going to be windows-based. You will have some Macs and you will have some Linux. Okay. But third party applications are where attackers are looking first and they are the least consistently patched. Okay. Deploy and assume it worked. You need to verify things are going to fail. Patches just fail. There's several reasons why they do fail. Sometimes it's space. Sometimes it's memory. Sometimes it's just a bad patch. Sometimes things get interrupted. It just happens. Patches are going to fail. Okay. So you need to verify. And what just released the closed loop. Okay. So identify, prioritize, remediate and verify. And this is how it works. This is how it works now. Now you need to know what is exposed. Ranked by the world, real world risk. Sometimes you can't patch everything in a single day. And when you go into your end site, if you go into your end central server and look at vulnerabilities and do it, you know, across all of your customers and central, it's called the service organization level. If you go at that level, you may have millions of CVEs. I had a partner challenge me and say, well, this is wrong. I can't have millions of CVEs. There's no way. That was very verifiable. Remediate, fix where you already work. Now it's a say 550 plus, it's actually higher than that. There's 550 managed apps across all three operating systems. Again, we've adopted new technology. So we're able to do more. It used to be an end central, we used to do a native 100. Not anymore. We do 600 and I think it's now 617 third party apps. So patch, uninstall our script from the same console. So there are going to be applications you just don't want on your customer. You will have to force uninstall some things. Trouble reboots and wait and patch. Okay. So there's plenty of automation out there that you can use as well to help with this. I've adopted probably seven different ones on the developer portal. And again, you don't have to use exactly what I built. You can take what I have and change it, make it your own and then verify, prove it's actually closed. Okay. Remediate and then verify. On demand rescan confirms the finding is closed. And you can do this in real time. And the other part of this is we have Enzo, we have AI baked right into end central. You're going to be able to ask Enzo to verify. Poor posture from evidence, not assumption. Denver, my man, I need to show more audit trail, I think. Identify and create ticket and then patch and close ticket. You can do that. I find that a little noisy. For example, when I used to manage connect, close manage, right? That was my PSA when I worked at an MSP, largest MSP in Canada at one time, back in 2017. Well, 2017 to 2020. It was one of the biggest. And what I can tell you is I used to use an entirely different service board for patch and also for self healing. I used to capture this. So I would generate a ticket, right? Patch it. And then because if things are patched, things go back to green, what will happen is that it should auto close. If it doesn't, well, then what I would do is assign it to technicians to investigate or what have you. Because there are several things that can break in patch management. We're going to talk about that as we go through. But there are things like PME, there are things like Windows Update. If Windows Update is broken, we're not patching the device. So there's things that you need to do and look and see so that you can understand the entire patch journey. But verification is that that piece, right? So and we can riff on this one on one Debra, if you ever want to hit me up on, on slack, uh, prioritized by real risk, then ask CVSS tells you how bad it could be. EPSS and Kev tell you what is actually being exploited. And if you actually look at CVEs, typically there's a yes under Kev, not always. Um, Microsoft Edge often isn't always actively exploited, for example. Okay, so let's drill into this a little bit. CVSS, how severe could this be? Necessary, but on its own floods the queue with criticals. Okay, so CVSS of 10. Well, it tells you how bad it is. EPSS, how likely is exploitation? Okay, so I find that that EPSS is a little better for understanding what is the probability. A probability of this CD is getting exploited in the wild. This thins the queue. So again, between CVSS and EPSS, you can really understand where you should start. Okay. And then CSEC Kev. Is there a yes? Well, it's happening. It's out there. It's being exploited. Your most exploitable devices rank instantly. Okay. So the good thing is you can filter on that. And again, you can ask Enzo. So if you see CVSS, EPSS, and you know, everything pointed to like a really bad critical CVE, you can simply just ask Enzo, which of my devices are exposed to CVE 2026-12345? You know, uh, what are my exploitable endpoints right now? What patches failed last night? So most people aren't adopting Enzo as the way to action things, and you should be. Okay, so it's baked in. Use it. It can help you. It can definitely help you to start. It can also help you to verify. Okay. Give me a remediation plan. Tell me where to start. This is what AI can do. It can, it can help you begin that journey. And again, it doesn't have to be just you. Throw some of this at your teammates as well. Okay. And a mitigation script if I cannot patch. So when you go into vulnerability management, we'll go into it a little bit here, is that you will see that there's not always a patch. So if you see something like Putty or Notepad++ that has a, you know, C of a CDSS of a 10 and, you know, EPSS score, that's really high and a yes between CISA-KEV, then it's KEV, K-E-V, I call it KEV. But it's one of those things where you may have to just remove it. Now, other times is there may not be a Microsoft patch for it. So you have to kind of understand that it's there and you're dealing with it. And by the way, any of you can ask questions at any time. I'm glad Denver is. Can you do that for patch, each patch update, not just total number? You can. Oh, so we can do for each patch. I would say that would be a lot of noise. But I would say with some work, we probably could. That would be a ton. You're talking like Denver, if you were to go into your NCentral and look at the SO, look at total vulnerabilities, right? Millions. Now you're probably from monthly patch cycle, Microsoft did what, 488 last month. Like it's, it's, it's getting crazy out there. So I do want to say, like, maybe we should do roll-ups, you know, that kind of thing. This all happens all through the month, right? Like, again, the bulk of patches do come out on patch Tuesday, but Microsoft breaks something that reworks the metadata. You don't even see it. I get to see it, but the patches change over days, right? This is the, the risk mitigation piece is that Microsoft even understands that they have to rework patches sometimes. Reaching control through party patches. Okay. 617. I'm, I'm actually going to pull it right up for you, you know, just so you can see it yourself. You can go to the URL. I'll even put the URL directly into the chat. Okay. Where did you go here? And where's the chat? I'll put that right there. So you have it. Okay. So supported third-party patches, 617. That is for both NCentral and Insight. There is no difference when it comes to the new patch management for Mac and Linux. Windows is, is coming. Okay. 249 vendors, 585 auto update, 617 manual. Okay. Vulnerability variants, auto update variants. Okay. So it's all here. Tons. Okay. So I'm not going to go through the entire list cause it is a lot as you can see, but, um, get the stuff updated. Now I'm going to show you how to do it, of course, but, uh, I do want to at least show you that there is a, you know, bookmark that if you want, because it will grow. Right now in 617, I'm hoping it's gonna be closer to a thousand by the end of year. Okay. Um, no, I have, I've lost the aspirations by the way. Um, so if Chris, if Chris Dunsmore is listening, um, you're not on the hook for that. Um, so again, 617 managed applications today, tested in-house and verified for install success. So we're verifying every single one of these. The controls that make it deployable, automated approvals, wake and patch, patch caching, controllable reboots, patch anywhere, patch everything, close networks, build vetted patch list for offline and isolated devices. It happens. You know, you have customers with, oh geez, I remember when I was managing a customer, it was in a, they had some optical technology, but when they built their software, it was built for windows XP. Um, I couldn't patch those devices. So I tried to mitigate the risk as much as I could get them off the internet back and that kind of thing. Okay. So you have to do the same. Also, my good friend, Jess Walpole, the CTO, Fortress, um, which is one of the major outfits in the United States. Um, it works and it works really, really well. Okay. So, and we're seeing really good statistics, um, for all of this. You will get into failed patches. So don't think it's bulletproof. Um, it happens. Okay. Live demo, closing the loop in the product. One CVE, start to finish, found, ranked, remediated and verified without leaving the console. Identify and prioritize, remediate and verify within zone. Those are the three things that you should do. Now, not all of you are equipped to have a dedicated patch person. The larger outfits, uh, Denver is one of them. Um, you definitely will, but somebody has to take this on. It has to be part of your go-to-market strategy with your customers. You have, you have to patch. You just have to daily. The patch masterclass. Okay. So we're going to get into it, but I did want to tell you, because this is where I'll get actually preachy. Um, only cause I get to work on scale, right? I get to work on Linux. I get to work on Mac and I get to work on of course, windows being the bulk of your fleet, um, across all of you. Um, so I, I speak to some of the best managed service providers and some of the largest mid market or small enterprise customers on the planet. And I take their best practices and your best practice. If this isn't something I dreamed up, this is what you, some of you are doing already. And all I'm doing is trying to hopefully, you know, align a lot of you, not all of you, but I'll align a lot of you so that you're doing the best thing possible. Okay. So I'm going to go into a patch masterclass next month. Unfortunately, there was going to be the section over here to the right where I was going to give you a QR code to register. Unfortunately, my marketing team didn't get it up on the events website yet. So, um, coming stay tuned. Um, you got this, you got this and you got into this one, you'll get into the next one, hopefully. Okay. I'll make sure. Okay. So that's where I will be using, uh, both and central and insight, or maybe I'll just pick one and we'll see, I'll figure it out, but it's one of those things where, um, I want to show you how to do all of this. Okay. And what the best practices are and that, and for any of the end central partners on here, yes, we're still using legacy windows, uh, the legacy patch management or classic I'm called legacy. We'll call it classic patch management for windows. Um, but there's things we still have to do in that. So I'm going to show you what, um, the best way possible is now I'm not going to do a Q and A yet. Let me back that up. All right. So that's enough slides. And then I took up half an hour. Uh, I probably need another 15, 20 for, uh, get out of there. Um, let me go over here and pull over. Now I am going to use my in central. Um, but again, this is going to be the exact same thing for insight. So, you know, use your imagination. All right. So we're going to, this is my lab. This is why I'm using it. Sorry. Uh, and central, my inside lab has like three devices in it. This one has many more 44. So invulnerabilities. Okay. So you, you won't see this in your in central today, by the way, you know, we do have like things like dark mode, you know, make it classic. Here it is. Cool. Um, for those who do not have it yet, I'm just going to rely on the default. I'll skip that tour. Let me go back to default. There we are. Anyways, long story short, I'm going to come into my lab again. I'm going to go to Ecoverse and you will have this very soon. This is 26.4.20. I believe. Look, I believe it's version 20, build 20. Okay. Now, when we get into views, we're going to go into, or Ecoverse, we're going to go into, uh, vulnerabilities. And then we're, what we're going to do here is see a list of all the detections. Okay. So I have my vulnerability ID. I'm hoping you all know what that is. You can click into these, right? What is this one? Let's click in. It does a flyout panel, says important, tells me what's affected. I can click into those links to get more information. My guess, it's probably a Chrome vulnerability. So, uh, or it's Chromium, one of the two. And then I can get the details, right? Vulnerability ID, severity important, risk score, CDSS of 10, which is commonplace. Uh, and then what we're going to do here is update available. Okay. So I know there's a patch for this. Now you might be going, Jason, why haven't you patched it? Well, I need to be able to show this stuff. So I'm not patching that. I try to patch it once every quarter. Um, I'm doing this cause I need to be able to show you stuff. So, um, if I was, uh, actively patching devices, I would be doing this, uh, probably daily. Okay. And then actions, you've got actions to the right-hand side, you know, kind of do a reboot and run a script or run another scan. It's all here, right? Now there's my vulnerability. Okay. So you can see again from here, flyo panel gives you more affected assets with devices are actually affected. So I have Python on several devices. Well, um, mine, mine is updated. Uh, Paul's is a little bit of a date and then the affected software. So Python 39, 64 bit across, you know, these three endpoints. Now, what do we do? Well, I'm going to select all and do stuff. Okay. And you can see the activity, like anytime you run a scan or, you know, remediate a device or run a script, it's already here. So I'm going to go back over to all detections and do it from this view. I'm just going to select all, by the way, filter, right? So I prebuilt this already. So threat status is any of unresolved again. So it's resolved or unresolved. So you can, if we're going to start patching things where we want to look at, you know, unresolved, what is the severity? I'm going to start at the highest critical or important, moderate or low. I'll leave that for later. Okay. Or maybe I'm going to leave that for my weekly, right? And my customers, I want to do all, oh, this is my lab, right? So trade research is my lab. And then we have Lewis's lab called security lab. Both are highly unpatched. Okay. So, and again, there's only about 50 devices across all of this. And then you can see all of this here. Now, the good news is if I just want to drill into some of this, I want to see trade research or the security lab. I can see what's going on. Okay. And Lewis's lab is 1243 vulnerabilities. Can you imagine what would that be like across a, you know, an MSP that has 10,000 devices? Crazy. So when we come in here, what do we want to do? We obviously want to remediate. Now I'm going to select all because I'm not going to pick on any of these patches and Lewis's lab, but then I can click on remediate. It does take about a second or two for that to kind of change colors from gray to blue. I think we'll probably address that soon. Again, I can filter on this. Maybe I don't want every single one of well, these are all the same desktop, but I'm just going to select all, click next. Now let me go back. I did this earlier. One second. That's because I filtered on everything. Let me just go back to here. Don't tell me I broke it. No, we're good. Okay. So again, I'm going to select all, remediate, and then click next. There we go. Okay. And then what we're going to do is configure a schedule. Okay. So I can just install right now, but maybe I have customers that are sensitive to downtime or what have you. Maybe I'll do this at 3 PM, 4 PM, end of day. You know, your customers better than I do. Again, I get to be preachy about some of this stuff. But again, at the end of the day, you have to account to your customers. So keep that in mind. Okay. Enable retry, turn that on, repeat daily, weekly, offline assets. Maybe they're not in the office today, right? Maybe they took a vacation day. Install when that comes back online. And then what do you want to do about reboots? Now I will tell you, we need to do more around reboots. All right. I can tell you this is a work in progress. So as it stands today, it's do you want to reboot or not? Again, that's where I typically accompany automation. If the flag for Windows patch is there, what I'll do is reboot the device or actually ask the user to reboot the device. If they, you know, don't comply within a, I used to do for 21 days as a default, I probably should lower that to seven. But if they haven't rebooted the device and it needs a reboot for patch, seven days. Okay. I can just click on confirm and then this flips to a confirmation page. I'm not going to patch my lab today. So I'm going to leave it right here and click X, but that is how you can do it from the vulnerability. Now, what we're going to do is come up to patches. Now, again, this is for Mac and Linux today. I'm hoping by the end of this year, cross my fingers, that we'll have a Windows patch in here as well. Okay. And then what we're able to do here is we're going to be able to come in, see what the pending patches are, any failed patches. Now I'm, I left them here because I actually want to be able to show some things. Like I don't have anything pending yet, but if I schedule something for later, it would then fall into pending. You can come in here and cancel it. You know, do it now if you wanted to set a new schedule. Failed patches. Again, I can do things like retry. And then you have a rollup of what has been completed. Okay. So if I just walk you through this really quickly, what do I want to do? I'll do one, just we'll do Python. Okay. So I'll click on that one. And then what I'm going to do is simply install. Now it's coming with more like policies and schedules and what have you. Those are the kind of the next steps I would say over the next quarter. Okay. But then we'll have, you know, Windows patch and all of this as well eventually. Okay. But you get to see what's happening. Patch name, patch ID, publish date. Right. Some of this is not old. So this is brand new. The classification, it's an update on Windows and Mac. Right. I do have a Mac in here somewhere. So there's Joe's Mac. I want to come in and click install. And then what I can do is select that and install patches. Okay. Nice and simple and easy to use. Now security insights. What do we have here? Okay. We have unresolved vulnerabilities. You can actually click on it. I know a lot of the names are cut off or what have you. That's because they're wordy. The font has to be always a decent size. But you can see the entire name when you hover. Okay. Exploitable devices, failed patches by severity, and assets with available patches. And then in here, what I can do is I can click in. I can start drilling into some of these. I can see what the patch deployment lag. I have asked that we actually be able to configure SLA as opposed to providing SLA. But we have to start somewhere. Okay. So where you can see that my 12 month average lag is less than a month. So I'm doing an okay job for a lab. But you can see my three month average lag is 21 days. Okay. And then I can come in and see like outdated patch scans and reboot statuses right for Windows, Linux. And it's all right here. Top vulnerable assets. Now, again, I can rely on my dashboards that I provided for you. Or you can ask the right questions. So let me just grab, I'll just grab this one right here. And Enso is going to load up. Can you tell me more about, again, Enso is fairly quick. So it should be able to give me something here in less than a minute. Just going to have some water here. Now, I asked a basic question. It's still thinking. Okay. You know, can you tell me more about this? Well, it gives me a roll up. Maybe you don't want to drill in and go through three tabs and try to get your own understanding. Just give me a summary. Right. Here it is. Right. CVE, severity, tells me to all of this. I can export this as a CSV as well. Comes with that. Effective software, Edge, Chrome. This again, this is a Chromium vulnerability. And I can see, you know, what effective devices. Maybe I want to, you know, pull that into a filter or something. Okay. Export that. Where are patches available for Edge? Well, odd. Where's the one for Chrome? Again, sometimes there's not always patch. You're going to have to either wait or deal with it. It's just how it goes sometimes. Again, these things, these things are coming out, you know, every single day. Okay. What is another good one? I wanted to show. Can you tell me which devices have the worst CVEs? I'll just keep it really generic. Might even be that CVE. Let's wait and see that a little bit here. I don't know if you can see that on your screen as well. But here we go. Okay. So we've got three. Oh, it was that Python one that we had earlier. Okay. So CVS is 9.8, Restore is 81. Tells me the effective software. And then what I would do is go into patch for the vulnerability and probably patch that. And here it all is. A vibe, right? Now, let me just check to see. Oh, there's a bunch of questions. I'm sorry, guys. So I have three monitors. I look to the right, or sorry, to the left. And I wasn't looking to the right where, you know, my go-to webinar master console is. So let's look at some of these questions because I don't like just talking and, you know, ignoring you guys. And Sergey, tell us more about controllable reboots, please. I have to drill into it. Our hours are scheduled to reboot daily at 7pm. If a reboot is needed, but the machine's not online at 7pm, never reboot, nor does it try to in the morning when the machine is back online. Does this new version of patch management address this? Not yet. Actually, if I go back into vulnerabilities, I'm going to say yes. More and more is coming on what you're describing. Effectively, we're going to be introducing policies very soon. So you're going to have, I would say, more granular control of this. However, in the meantime, when I have this all selected, I click on remediate. Right now, if I go set a schedule, again, you can choose your date and schedule and everything else. But right now, when it comes to things like third party patches like Chrome, a browser, you're going to force close that application. The great news is when you force close and bring Chrome backup to the customer, like, I don't know how intrusive, again, it's your customer, not mine. I personally would force close any browsers. So if I'm trying to patch a browser like, you know, Edge, Chrome, Firefox, et cetera, I would probably force close before install. When they try to reopen it, all those tabs come floating back. Right. So I would say this, more is coming around the schedule piece. Okay. Right. So again, I did it. Here, I'm going to go back. I'll have to sort through that. It does say, start date and time, install now. Maybe I have to go back and actually, let's go tomorrow at 1042. See if that helps. There we go. So it isn't set to install now. There we go. I just, I thought it was weird. It said that even though there was a schedule already kind of in place, I get it. Okay. So as a reboot, do not. So again, more will come around granularity of setting schedules to reboot whenever you feel like. I'm hoping there's going to be, you know, things like branding and a whole bunch of the cool stuff. So I have seen mock-ups of what is coming, but again, like that legal disclaimer says, some of this may get delayed. Okay. Next question here. Hopefully I addressed that, Sergei. Rob, can Enso easily provide a list of patches that may have a high CISA CAD score to help product owners? Yeah. Let's try that right now. Why not? I mean, we still have 50 minutes. So let me close this. I'll ask Enso. Let's do something like, please rank CVEs by. Now CISA CAD is a binary. It's yes or no. Right. So if you come here, let me just, let me just go over here. So it's going to say the CISA CAD unknown exploitative vulnerabilities catalog is not a binary list. A vulnerability is either listed or is it not? Okay. It says it is a binary list. So it's a yes or no. So there is a score here as well. Let me find it here. Where is it? CVSS score, CISA CAD is yes or no. There's another score, like an at-risk score. Let me drill into one of these. I saw it earlier. Maybe, let me see if there's a category for this. Well, I'd have to turn it on, dude. Okay. There you go. So now we have this. So let me slide that down. Risk score, where are you here? There it is. So you can do it by risk score. And again, Enso is aware of all of these columns. So by the way, it just came out yesterday, is that you can even go, I'm actually going to test it. I'm just going to show you here. Move this over, get out of there. And I'll look at this because I want the affected device or asset. So I'll do PAWS. I know this is one of these non-essential lab devices. Can you please, so say I just installed Apache. Can you, and I want to do this at my end of my day, right? Can you please reboot? So there you go. So you can do it this way as well. Countdown timer. Now, I have never tried this on mass. So I have done this before with one device. So be careful, right? So countdown timer, 15 minutes message. I'm sorry, I have to reboot your device for a security issue, whatever you formulate your own messages to your customers. Okay, allow them options. You want to snooze, you want them to be able to cancel. So they can push up to 30 minutes, let's say, three times and then reboot. So you can see that there's more coming around this. Okay. Again, we're getting to some agentic AI examples here. I'm not actually going to reboot because I won't pay attention to it after this webinar, but it works. Okay, I've tested it. Okay. So next question here that was, where was I? Sorry, there's a ton of stuff here. Go to webinar is not the greatest for kind of the Q&A piece. So I'm going to just pick on a few here. Leopold, pick Insight for the demo. All right, Leopold, next time I'll do Insight. What version of a central server software do we need to install? Okay. What version of a central server software do we need installed to support these features? Well, you had better be on 26.3 hotfix 2 at the very minimal, based on things like CVEs, that kind of stuff. Hopefully you've heard about it. If you're not on that version, move quickly and get it installed. I'm going to start at the top here. From my Insight perspective, the concern I hear from my team is that once we pass the vulnerability, the vulnerability list still shows unpatched next day or day after. When or how? You can, by the way, you can actually run a scan again across those devices, and that should work within minutes. If it's not, please log a ticket because that is the expected behavior. So again, unless we get feedback from through support channels, we don't know what the problems are. So if your team is not seeing things actually patched when they are, because of things aren't updating in the console, please log your ticket for that. That was from Josie Menohar. How to patch on demand? Okay, how to patch on demand? I have to click into all of these because then it gives me a little window. How to patch on demand on multiple Linux servers? How to patch Red Hat servers? How to subscribe? How to subscribe Red Hat servers? I kind of showed you a little bit earlier. I mean, it's, you can go by patch. Let's do it again really quick. You know, you can choose your, let's go with this. I'm not actually going to install it. But if I click here, actions, install selected updates, you can select all these if you want to. Next. And again, I'm just going to choose this and actions. Okay, install patches. That's it. That's, that's how it works. If you want to do it by patch, you want to do it by vulnerabilities, more, more kind of granularity. Today, we're a little ahead on vulnerabilities. More to come on the patch. Okay. Let's see here. Kevin, my buddy Kevin. Will the available patch clear before the machines are rebooted when they are rescanned? Will the patch clear before the machines are rebooted? No. They need to be fully installed. So again, I'm not going to get preachy with you, Kevin, but it is not installed until it is rebooted. So if they are scanned afterwards, I would say yes. But before no. Next question here. I can't believe how many questions are. How long can you have a pending patch job if a device is offline and you want the patch to install during the next time the device is online? What is that? My guess is that it sits there infinitely. Unless you clear it. If you can clear. Let's look if I go into do it this way because there's more regular options here. So I come in here, I click on remediate and I select all. Click next. I'll do schedule. Install when online. If an asset is offline, patch will resume when the device is back online. As far as I know, it's going to sit there until it comes back online. And then once it comes back online, it should queue and install probably within five minutes. If you don't see that behavior, please reach out to me because I would expect that to work that way. Can you ask Enzo? This is from Leopold. Can you ask Enzo like for an executive summary for devices for X client? If you've never been to one of my Enzo webinars, it does an amazing job on executive summaries. Please test it. It's pretty darn good at what it does. So I would say yes, definitely use that. So that can be presented to a client or will this be a two step process? Ask Enzo for the devices and later ask Chachapiti Copilot to create an executive. You can do both. Why not? Right. Like maybe you want to put new logos. I mean, we're not putting logos and something on, on, on the summary or anything, but can you run an executive summary on Celtic Cider Company? Now I've got like dyslexia today or something. I think that's right. Now I'll leave it there while we talk and I'll pull that up once because an executive summary takes about three minutes. How do we exclude stale devices from the vulnerability report? Now that is a great question. That could be part of your filter. I'm doing it wrong. Here we go. That is a great question. The unfortunate part is some of the Ecoverse features aren't aware of things like the monitoring and in central. Maybe that's why. But it's unfortunate because under the assets view, it does understand if there is an issue. There's a device status. That might be really good feedback for Jeff when I speak to him later this afternoon. So I'll, I'll definitely bring that up with him. I appreciate that Sayed. My buddy Jordan. Can we have a patch reboot stay in a pending state if a device is offline and misses it and misses it force reboot window. Right now there is no way other than extending the reboot window which unless done manually also includes devices that are already rebooted. Can you have patch reboot stay in a pending state? I'm just trying to. I think it's a pretty decent idea because obviously it's offline. Well I have to get with guns more on that one. Only because I don't think you can do that at least in the modern patch view today with maintenance windows. Obviously when you set up the reboot you can obviously choose to do that. But there's no way to kind of infinitely do that in classic and central today. See here again there's a ton of questions. I'm missing so many. I'm going to do two more. Leopold if there are programs on the customer devices that you do not want to be on the devices how can you remotely uninstall them? And OK more on that coming soon. So if there's going to be logic built in to patch and vulnerability management that's going to give you. Let me just check one thing. Also I'm on a server. So this is my nerds training server that both engineering they all have access to it. And I'm usually the first person who gets like you know the test. But if I had. I'd have to do it by patch. More to come on that. I know we're working on that. I thought it was. I thought maybe we actually delivered it. But we're you're going to be able to uninstall applications. Because if we can patch them we can definitely uninstall them. That's usually a quick switch in the command line. OK. And one more question who am I going to pick on here. I'll pick on clip. OK. And again I got rid of that executive summary that I was working on. Let me see if I can go back here. Let's see if we're finished. May not have. But Clint says when you ask Enzo to check if a vulnerability has been remediated. Does it just look at the portal or does it actively run some sort of script recheck of the device. So this is how it actually works. OK. Only because everything that you see in here has an API. Every single link. Right. So if I. So here's the executive summary that I think we uphold or somebody wanted me to push out. So you may want to just take this and throw it into chat GPT and add your logos and that kind of stuff. Hopefully we'll be able to do more of that as we improve on. And Enzo is fairly new. So we're going to do more and more on that. So I'm just going to close this real quick and I'm going to close that. So everything you see here is a link. Right. So everything has a data point and everything is API first in GraphQL. And if you're not familiar developer. So again I'm just going to click in GraphQL. There is an enable MCP for GraphQL. This should be called enable GraphQL MCP. It's just called the enable MCP for now. That will change. We will have several MCPs very soon. But when you come in here. OK. If I go into. Where is it. I hate that big area. View the docs. No I don't want that. I want. Where is it. There's a. It's. OK. This explains to you. OK. Here it all is. This explains to you how to get started with GraphQL. Long story short is that there's a whole schema that you can actually take from here. It's the next step. And then what you're going to do is take that schema throw it into your AI of choice throw it into Enzo. Ask it to build a query. But what happens is that just to answer your question is it's based on what is real. Right. So in your example you said when you ask Enzo to check it for vulnerability has been remediated. I know to you you think you've remediated. Does it just look at the portal or does it actually run some sort of script recheck on the device. It does not. Nonetheless you've actually done another scan which you can do. Once you have scanned I would probably give it. It depends on the volume. You know you're not going to rescan two million devices in two minutes. Right. But give it some time. And then yes if Enzo should be in the now once the device patch has been installed and also effectively rebooted. That is the life cycle of patch. In third party it's a little different right because with browsers or what have you you have to close them first update them when they reopen. They should be good to go. Right. So third party is a little different. It should be if it gives you an answer it should be pretty accurate in terms of its current state. Now we're over time. I hate when I do that. I'm sorry. What we're going to do here is we're going to call a wrap. I hope you enjoyed the webinar today. I'm going to pull this back. I'll go back to the Q&A. Oh that's wrong. That's a one slide. We go back to this. There we go. And again if you're new to Wincentral and you've not tried it before or insight what I do welcome you is to check that out. What I want you to do is if you have additional questions that I didn't get a chance to answer please send me the question and reach out. My email is jmurphy at n-able.com. I appreciate your time. Thank you so much for joining and I'll see you next month.
