KRUVAI Patch Management with a human in control
Vulnerability patches go out automatically inside your maintenance window. Upgrade patches wait for an approver. Every pending patch tells you why it has not been pushed.
Patching with a person in control of anything risky
KRUV Tech AI Patch Management keeps Windows, Linux and macOS endpoints patched with minimal manual work.
Vulnerability patches
Pushed automatically inside the maintenance window.
Upgrade patches
Wait for a designated approver before anything is pushed.
Clear reasons
Every pending patch shows a why-not-pushed reason, so nothing is a mystery.
AI that assists, rules that decide
An optional AI cycle runs every 15 minutes, but the rules engine always makes the decision.
Security Edition
Adds the endpoint controls security teams ask for, in the same console.
On-prem first, air-gap capable
The core product has no required cloud calls.
- Threat feeds can be imported from a folder
- The AI layer is off unless you supply your own key
- Online KEV / EPSS fetching is off by default
- SQLite for demos or PostgreSQL for production
- Ready for fully on-prem and air-gapped installs
Simple, lightweight architecture
One Python (Flask) application, served by Waitress, with two process types sharing one database.
Web server
Serves the console and the agent API.
Worker
Runs the AI cycle every 15 minutes, plus SLA, ingestion and remediation jobs.
Agents
Lightweight scheduled agents for Windows (MSI), Linux and macOS.
Simple agent protocol
Agents talk to the server over HTTPS with four calls: enroll, check-in, inventory and result, which makes troubleshooting straightforward.
Five roles, least privilege
Each role has clear boundaries.
Super Admin
Everything Admin can do, plus switching the module on or off and managing Super Admins.
Admin
Full control of settings, agents, the approver list, allowlist, AI cycle and destructive actions.
Patch Approver
Approves or rejects upgrade patches. Must be on the designated list.
Operator
Runs the AI cycle, changes rings, manages the allowlist, deploys software and runs remote sessions.
Auditor
Read-only access to every page, the audit trail and the self-service portal.
Safe rollout, built in
Defaults are conservative so you can prove it before you trust it.
Start with Dry run On and Auto-push Off (the defaults).
Populate a pilot ring and observe it for at least two weeks.
Turn Dry run Off only after the pilot is validated.
Use “Max endpoints per cycle” for a staged, broader rollout.
Keep the kill switch ready. It stops all pushes immediately.
Servers are conservative by design: every server patch needs approval by default, and servers never auto-reboot.
Training for your team
A full training guide and overview cover installation, configuration, agent deployment, AI patching, Security Edition features, audit, troubleshooting and hands-on labs, for IT administrators, operators, approvers and auditors.
Training material is shared with customers during onboarding. Ask us for the overview.
Book a 20-min patch management discovery
Tell us your endpoint count and OS mix. We will walk through the safe-rollout approach and what a pilot ring would look like in your environment.
Booking calendar
Email us or use WhatsApp to book a 20-minute call.