Windows and Linux patched together, a STIG/CIS-aligned baseline for every machine, two-person approval, change windows, and a tamper-evident audit log.
A hardened, supported console on Salt that manages Windows and Linux together, across cloud instances, on-prem servers, or both, packaged so it installs in an afternoon and upgrades without breaking your customizations.
Every machine in a single web console on top of Salt, Windows and Linux side by side, with role-based access and a layout your techs can actually use.
Windows Update and Linux package status plus a scored STIG / CIS-aligned baseline for every node, Windows and Linux, in one exportable audit view. The baseline is a focused set of high-value controls (9 on Windows, 7 on Linux), not a full DISA benchmark scan.
Click Install updates or Apply baseline on a node, or Fix all for the whole fleet. It runs under your role, and the action lands in the audit log under your name.
Critical services are watched on every node. If one stops, Gardience restarts it within seconds and records both the drift and the fix.
A built-in update cache for Debian, Ubuntu, Rocky, AlmaLinux, and EPEL: each package downloads once from its official source, every machine installs from Gardience, and signatures are still checked on each machine. Carry the cache, and Windows update bundles, into a network with no internet. Gardience itself installs from an offline bundle.
Turn on IIS or OpenSSH on Windows, nginx on Linux, or push software from a private package repo, from a menu instead of a script.
Your technicians log in with the directory accounts they already have. Every action lands in an audit log.
A tested release every quarter and a fix for any relevant CVE within a week. When an advisory drops, the email comes from us, before you hear about it elsewhere.
We stand it up in your environment, air-gapped if you need, bring each Windows or Linux host under management in one step, and handle the upgrade path.
Define a task once. Your help desk runs it from a form, never a terminal, and every input is checked.
Patch the pilot ring, verify, require a second person to approve, then patch everything else. Reboot steps wait until each machine is really back.
Changes outside a group's window are held until it opens. Lock a domain controller and it refuses every change, enforced on the machine itself.
A laptop off the VPN gets its job the moment it reconnects, instead of a red failure on your screen.
Domain, BitLocker, .NET, SELinux, disk, and admins for every node, and a one-click evidence zip with checksums.
Each machine is checked first: free disk, a healthy package database, reachable repositories, and on Windows a pending restart. Machines that are not ready are left out with the reason and the fix, instead of failing halfway.
Chrome, Zoom, 7-Zip, Adobe Reader, and the rest of the public winget catalog, updated silently, approved, and audited like any other patch. The dashboard shows your patch success rate for the last 30 days.
Start a trial and run one command on a Linux server. It installs Docker if needed, adds your license, and prints your sign-in. Measured at 4 to 5 minutes on Ubuntu, Debian, RHEL, Rocky, and AlmaLinux.
A REST API with scoped keys, and a built-in MCP server so Claude, Cursor, or Copilot can answer "what failed the baseline?" and request changes. Changes an AI asks for wait for a person to approve.
Tested on Salt 3006, 3007, and 3008 together. See the compatibility matrix.
Two or three lines is enough. A person will reply and set up a short call to size it.