Every CVE on every Windows and Linux machine, checked against the vendors' own security data, and fixed in one approved run on only the exposed machines.
Gardience checks every machine against the vendors' own security data every day and shows each CVE with the machines it reaches and whether a fix is waiting. When the next PHP2Shell lands, you look it up, press Fix, a second person approves, and the rescan shows zero.
Debian, Ubuntu, the Red Hat family, and Windows, each checked against its vendor's own security data. The heavy lifting happens on the server, so machines only report what they have installed.
One button installs only the updates for that CVE, plus anything they require, on only the exposed machines. Every other pending update stays pending, and the run goes through your approvals.
A CVE new to your fleet ranks with the critical ones even before the vendor rates it, and an alert goes out when it reaches your machines. PHP2Shell sat unrated for a day.
Import your vulnerability scanner's CSV export. Gardience matches each host to a machine by name or address, confirms what its own check also sees, and offers Fix only on those.
Tested at scale: 1,020 Windows and Linux servers patched and rebooted in one approved run, in about 20 minutes, and 600 web servers exposed to PHP2Shell taken to zero. Read the test and the commands.
Two or three lines is enough. A person will reply and set up a short call to size it.