Patch management without the 2am surprise: rings, windows, and rollback

Unpatched systems are how most real-world compromises start, and every MSP knows it. But the reason patching gets deferred is rarely laziness — it's fear with a good memory. Everyone has a story about the update that broke a line-of-business app across an entire client on a Tuesday morning, and one bad experience like that buys years of "let's wait a cycle and see."

The way out isn't courage. It's structure that makes the blast radius of a bad patch small and the path back short — at which point patching promptly becomes boring, which is the goal.

The structure, in three boring parts

• Rings: patches land on a small, deliberately chosen group first — IT's own machines, a client's least critical devices — and only promote outward after a soak period with no regressions. A bad patch breaks five machines, not five hundred.
• Maintenance windows: every client has agreed, written-down windows when updates may apply and reboots may happen. "When can we reboot the server" stops being a negotiation per incident and becomes policy.
• Rollback you've actually exercised: knowing which updates can be uninstalled cleanly, and having tried it, is the difference between a ten-minute fix and a day of reimaging.

Why this belongs in the same system as tickets

A patch that breaks something announces itself as tickets. If patch deployment history and the ticket stream live in the same platform, "these four complaints started an hour after ring two got KB-whatever" is a correlation the system can surface — and the agentic layer is designed to draft exactly that diagnosis for a human to confirm, halt the ring promotion, and propose the rollback. Across separate tools, that same correlation is a hunch a tired tech has to have at the right moment.

Good patch management is not brave. It is structured so that nothing about it ever needs to be brave.

Patch policy in Nexus is part of the endpoint-management module, and the honest status note applies here as everywhere on this site: see the platform page for exactly where that module stands today rather than assuming everything described above is live — the rings-and-windows model is the design commitment, and the pieces ship in the open, in order.