Connect a Linux server with its IP and SSH key. PatchWarden fingerprints the OS and every installed package, watches for new CVEs around the clock, alerts you, and applies the fix on your terms.
Real package inventory, real advisories, and a patch workflow your team can trust.
Every SSH key is sealed with its own AES-256-GCM data key, wrapped by a master key that never touches the database. Every decryption is audit-logged, and keys are never shown again after upload.
Detects the distribution, every installed package, running services and open ports, then matches exact versions against distribution security trackers - not guesswork from banners.
Per server: notify only, approve each patch from an email link, or auto-patch anything above a severity you choose. Full command output, reboot detection and a verification rescan.
Watch every scan and patch step by step: connecting, inventory, advisory lookups and verification, with a running timer.
The server's SSH host key is pinned on first connection. If it ever changes, we stop and alert you instead of connecting.
Organizations with admin and member roles, email invitations, and a record of who approved and ran every patch.
Generate a key just for PatchWarden so you can revoke it any time. Scanning works as a normal user; patching needs passwordless sudo.
ssh-keygen -t ed25519 -f patchwarden.pem -N '' sudo useradd -m -s /bin/bash patchwarden sudo install -d -m 700 -o patchwarden ~patchwarden/.ssh sudo install -m 600 -o patchwarden patchwarden.pem.pub \ ~patchwarden/.ssh/authorized_keys echo 'patchwarden ALL=(root) NOPASSWD: ALL' \ | sudo tee /etc/sudoers.d/patchwarden
Then upload patchwarden.pem when adding the server, with SSH user patchwarden.
Start free. Upgrade when you add more servers. Cancel any time.
Your first scan takes about a minute.
Start free trial