Managed patching · CVE watch · Monthly proof
Close the holes attackers scan for. Every month.
PatchTempo keeps your servers, web app and dependencies patched against known vulnerabilities. AI agents triage new CVEs and prepare the fixes. A person approves every change. You get a dated report for your cyber insurer.
- Read-only access
- Staging first
- Human approval
- EU data option
- scan3 servers · 1 web app · 412 dependencies
- cveCVE-2024-6387 openssh, high: affects web-01
- cveCVE-2023-44487 http/2 rapid reset: affects web-01
- fixpull request opened, deployed to staging
- test214 regression tests passed
- ok21 other updates merged after approval
- waitreboot web-01: waiting for your approval
- OPEN CRITICAL
- 0
- PATCHED
- 23
- WAITING ON YOU
- 1
32 days
median time for organisations to fix flaws in edge devices and VPNs. Only 54% were fully fixed.
500,000+
victims helped by France's national cyber assistance service in 2025.
HOW IT WORKS
Harden once. Then stay patched on a fixed cycle.
Most small businesses are not hacked by a genius. They are hacked by a script that found an old version. We make sure there is no old version to find.
- 01 · AUDIT
Free exposure audit
A check of your servers and code: outdated software, known CVEs, open ports, weak settings. Ranked, in plain language.
- 02 · HARDEN
The big catch-up
One documented upgrade: OS packages, dependencies, frameworks, configs. Easy doors shut, such as SSH password login.
- 03 · WATCH
CVE triage
New vulnerabilities are checked against your exact stack. Critical ones that hit you are fixed first, the rest on the monthly cycle.
- 04 · PROVE
Monthly report
A dated record of what was found, fixed and tested. The answer to your insurer's question: how do you patch?
CHANGE CONTROL
AI agents propose. Humans approve. Production is never touched directly.
- STEP 1Pull requestThe fix arrives as a reviewable change, never a direct write.
- STEP 2Staging and testsApplied to a copy of your app. Your regression tests must pass.
- STEP 3Human approvalA person signs off every merge and every reboot.
- STEP 4ProductionRolled out in your change window, with a snapshot to roll back.
- + snapshot before every change
- + full audit log
- + credentials scoped per client
- + agents run in a sandbox
SCOPE, IN WRITING
We close known holes. We don't sell "unhackable".
In scope
- Known CVEs in your stack
- OS packages and libraries
- Frameworks and configs
- Exposed services and SSH
Out of scope
- Zero days with no fix yet
- Software its maker no longer supports
- Targeted, well-funded attacks
- Staff laptops and phones
A best-efforts service with a written scope and patch delays by severity.
DATA HANDLING
Your configs are sensitive. We treat them that way.
- Read-only by default. Changes only through pull requests.
- Secrets redacted before any AI model sees a file.
- EU region option: Claude on AWS Bedrock in an EU region.
- A data processing agreement with the full list of sub-processors.
PRICING
Free audit first. Then a flat monthly fee per server or app.
The audit sizes the catch-up. You get a written quote for the one-off upgrade and the monthly plan before you commit.
- Exposure audit
- Free
- Hardening upgrade
- Quoted after audit
- Monthly patching
- Flat, per server or app
Common questions
Do I need to be technical?
No. If you run a website, a booking system or an app on your own server, we look after its security updates. Reports are written for owners, with a technical appendix for your developer.
Can an AI agent break my production?
Our agents have no direct write access to production. Changes go through pull requests, staging and your tests, and a person approves every merge and every reboot. Each change has a snapshot so it can be rolled back.
How fast are critical vulnerabilities fixed?
Patch delays by severity are written into your contract. Critical vulnerabilities that affect your setup are handled as soon as a fix exists, outside the monthly cycle.
Does this make me unhackable?
No, and nobody can honestly promise that. We close the known holes that automated attacks look for, which is how most small businesses get hit. Zero days, software its maker no longer supports and targeted attacks by well-funded groups are outside what patching can stop.
FREE EXPOSURE AUDIT
Find out what an attacker's scanner would see.
Tell us about your setup. We usually reply within two working days. No commitment.