We already run a scanner. Isn't that enough?

Only if something closes the gaps it finds. Finding vulnerabilities is the part the whole market already solved. The value is in fixing what matters and proving it gone, which is the work a scanner alone leaves on your desk.

Won't our RMM already patch everything?

Your RMM does most of the job. Where it tends to stop is third-party application patching, prioritising by real exposure, proving a gap is closed, and the vulnerability with no patch at all. Those gaps are where a dedicated tool earns its place.

There are thousands of findings. Where do we start?

With exploitability in your environment: the published score re-rated against internet exposure, local-admin need, a known exploit in the wild, and whether a patch even exists. That turns thousands of findings into the few that can actually be used against you.

What about a vulnerability with no patch?

This is the case most tools go quiet on. In-memory shielding reduces the risk in place until a fix exists. Detection and response still watches that system in the meantime, and the patch goes on the day it ships.

Can this be fully automated?

Largely. Ring and phased deployment and exclusion windows do most of the lifting. Someone still approves the rings and handles the exceptions, so treat any set-and-forget promise with suspicion. The automation takes work to build and maintain, and it pays back.

Does this count toward the Essential Eight?

Yes. Patch Applications and Patch Operating Systems are two of the eight controls, and the ACSC expects the vulnerabilities that matter patched fast, in some cases within 48 hours. Doing that by hand across every third-party application isn’t realistic, which is the practical case for a tool.

Vulnerability management and patchingInternal research

Fix what attackers can actually reach.

We match you to tools that close what’s exploitable in your environment first, and prove it’s gone.

Prioritise your patching See the research

Free. No fit, no obligation.

Architecture

Four problems, not one product.

Name which of these four is yours before you shop for a tool.

01
Seeing what you have
A static scanner takes a snapshot every few hours. Between scans, and across every device you didn’t know was there, you’re blind.
02
Knowing what matters
A scan returns thousands of findings. Working out which handful can actually hurt you is the labour that eats the week.
03
Too many tools for one job
A scanner here, a patching tool there, a separate operating-system patcher. Three consoles to do what should be one job.
04
The gap with no patch
Sometimes a known vulnerability has no fix yet, and it still has to be dealt with before one arrives.

The problem

Finding gaps is easy. Closing them is the work.

Finding vulnerabilities is commoditised. Every scanner on the market returns a long list, and your risk is in a few lines of it. The value sits in closing the gaps that matter and proving them gone, which is the part most tools leave to you.

Your environment decides which gaps matter. A critical rating might be a five in your network, and a low one might escalate because it's internet-facing and already exploited. Good prioritisation re-rates every finding against the 20 to 30 things true only of your environment.

Two of eightPatching applications and patching operating systems are both Essential Eight strategies.

What you get

What good vulnerability management gives you.

What closing gaps looks like, past the length of a report.

Effort spent where the risk is

Prioritisation by what’s exploitable in your environment, so your team fixes the few findings that can actually be used against you.

What to look for

What can the top platforms do?

Scanning and a patch button come standard; these capabilities separate closing gaps from counting them.

Risk-based prioritisation
The published score plus the data points unique to your environment, re-rating each finding up or down so the queue reflects real exposure.
Real remediation, not just scanning
Patching and deployment built in, so finding a gap and closing it happen in one console.
Third-party and operating-system patching together
The applications attackers actually target, alongside the operating system your existing tooling already covers.
Patchless protection for the un-patchable
In-memory shielding for the vulnerability with no fix available. It reduces the risk until the patch arrives.
Remediation validation
A re-test that proves each gap is closed, which is the evidence an auditor asks for.
Ring and phased deployment
Patches rolled out in controlled waves with exclusion windows, so a fix never takes down the business it was meant to protect.

Maturity

The backlog is usually bigger than the team.

Vulnerability management maturity, tier by tier.

Focused
Periodic scans, findings triaged by hand, patching left to the RMM or whoever has time. Many mid-market teams sit here.
Typical features
- A scanner run now and then
- Findings triaged by hand
- Patching left to the RMM
- A list that grows faster than it shrinks
Broad
Risk-based prioritisation, remediation and third-party patching working as one program, with the Essential Eight patch controls met as a matter of routine.
Typical features
- Risk-based prioritisation
- Third-party application patching
- Remediation tracked to closure
- Essential Eight patch windows met routinely
- One program, not separate tools
Covers what can’t be patched
Comprehensive
Everything Broad does, plus environment-tuned prioritisation, shielding for the un-patchable, and validated remediation. Start here if internet-facing systems can’t be patched inside Essential Eight windows.
Everything in Broad, plus
- Prioritisation tuned to your environment
- Shielding for what cannot be patched
- Fixes validated and evidenced
- Patching automated as far as is safe
- Proof ready for auditors and insurers

Vulnerability management and patching

Hygiene is one layer of three.

Prevention, detection and response, and hygiene share one endpoint, and each shrinks the others’ job.

01
Prevention
Prevention decides what is allowed to run at all. Controlling execution shrinks what could ever exploit a gap.
Explore application control
02
Detection and response
Catching and containing what operates inside what you have allowed, when something gets through.
Explore detection and response
03
Hygiene
Closing the doors before anyone tries them. Patching and remediation shrink the surface the other two layers watch. This is the layer you’re on now.

Tekspace Research

We research the vulnerability management and patching field.

Internal research

Vulnerability and Exposure Management

How fast do you fix what attackers can actually reach?

Closes the gap between finding vulnerabilities and fixing them, worst first.

What we found

Attackers use a disclosed flaw within hours, while most organisations fix it in months. Where a fix won’t land in time, a compensating control is the defensible answer.

Vendors assessed12 vendors assessed