NEW CMMC Level 2: SPRS −203 to 110, the technical side done in 35 minutes Node2Shell (CVE-2026-111497): find and patch it on Windows and Linux 1,020 Windows and Linux servers patched in 13 minutes in one approved run
BlogDocumentationSupportPartnersGovernmentContact sales
Proof

Every number we publish, and how it was measured.

Every number on this site comes with its test: what was run, on what machines, the conditions, and the files to check it yourself.

Start your free 90-day trialBook a 15-minute demo

1,020 Windows and Linux servers patched in 13 minutes in one approved run

What ran. On October 25, 2026 we built a test fleet on AWS for this run: 1,000 Amazon Linux 2023 servers (t4g.nano) and 20 Windows Server 2022 servers (t3.medium), managed by one Gardience server installed from the release bundle the way a customer installs it. These were test machines, not customer servers.

StepResult
Before, read straight from the Salt master1,020 machines answered, 64,000 updates waiting (64 per Linux server, a new kernel included)
Patch, requested by an operator and approved by a second person1,020 of 1,020 ok in 13 minutes. The requester's own approval was refused.
Reboot, requested and approved the same way1,020 of 1,020 answering again 4 minutes after the request
After, read straight from the Salt master1,020 fully patched, 0 updates waiting, every Linux server on the new kernel
Security baseline on all 1,0201,020 of 1,020 passing
Test conditions. The machines came from clean cloud images, not years-old servers with broken update stores or custom software. The Windows image was Microsoft's current one, so the 20 Windows servers had nothing to install: for them the run checked and confirmed. Windows patching at volume was measured in an earlier run: 34 Windows Server 2022 machines alongside 600 Linux machines, about 70,000 updates waiting, patched from the console in about 15 minutes; one machine needed a second run, and the log says so. On real fleets, a machine with a broken update store shows up by name with the reason, and one more approved run finishes it.

Check it: the run log, console before, console after, and the signed evidence pack exported from that server (Ed25519 signature, public key inside; 2,040 per-machine results, 0 failed). The servers were deleted after the run; it cost about $6.

CMMC Level 2: SPRS −203 to 110, the technical side in 35 minutes

What ran. On October 28, 2026: 50 fresh AWS machines, with 20 Windows Server 2022 and 2025 servers (with a TPM) as the enclave that holds controlled unclassified information. Gardience patched them, applied the CMMC settings and its security baseline, turned on FIPS mode, and encrypted all 20 system drives with BitLocker after each recovery key was in its vault (20 of 20). 35 minutes passed from the first step to a score of 110.

How the rest of the 110 was reached. About half of CMMC is people and process: policies, training, background checks, and building access. Gardience handled the paperwork: it drafted all 14 policies from the system profile, built the System Security Plan and POA&M, and has a filled-in template for each of the 17 records an assessor asks for. In this test a script then adopted the policies as written and marked the people, training, and facilities requirements as met, the step your team takes once that work is done. In this run, 22 requirements were accepted as met on Gardience's machine evidence alone. Gardience holds evidence for 52 of the 110 in all (6 fully, 46 in part); the partial ones also need a person to confirm the part outside the machines. In a real company, Gardience emails each person a link to sign the policies or upload their proof, reminds them until it is in, and asks again before a record runs out. Each item counts once a person confirms it, which is exactly what an assessor checks.

Check it: the run log, step by step with times.

Ansible playbooks over the Salt connection, no WinRM or SSH

Each command a playbook task sends goes to that one machine as a Salt job, encrypted with that machine's own key. Tested on real cloud machines, Linux and Windows, including a Windows playbook that writes a file with a secret from the Gardience vault.

Every release passes an attack scan before it can be signed

What ran. The release key signs only a build that passed the full release check. Its security part runs a signed-in OWASP ZAP attack scan of every endpoint, nuclei, testssl.sh, nmap, Bandit, and Trivy, plus our own tests for sign-in tampering, permissions, sandbox escape, and audit-log forgery. The current release, 1.23.1, passed on November 1, 2026 with 0 failing.

Test it yourself. These are our own tests, published in full. Gardience runs on your server, so your team can scan or pen test it with your own tools, no permission needed.

Check it: how each release is tested and what the latest round found.

20 platforms, each verified on a real machine

What ran. Every Windows Server release from 2016 to 2025, Windows 10 and 11, RHEL, Oracle Linux, Rocky Linux, SUSE, Ubuntu, Debian, and Amazon Linux, each with Salt 3006, 3007, and 3008 agents, joined a Gardience server on a real machine and ran its features: remote management, compliance scanning, the security baseline, patching, reboot and reconnect, and inventory.

Check it: the compatibility table, by platform and Salt release.

Where it runs

Gardience runs on your server, inside your network. It is not a cloud service: it sends nothing to us, and we have no access to it. The only exception is the optional Hosted plan, where we run a dedicated server for you, and the Security page says exactly what that means.

Found a number on this site without a test behind it, or a test that does not show what we say? Tell us at george@gardience.com and we will fix the page or show you the proof.

Try it on your own machines   Security overview