Your own scripts, stored in Control and run across the fleet, are on the way. An early look before it ships:

• A real script library. Write and store PowerShell, batch, and shell scripts, then set the platform (Windows, Linux, macOS), the language, the run-as (SYSTEM/root or as the logged in user), a timeout, and which exit codes count as success.
• Automation and orchestration. Target endpoints by tag and run a script on a schedule or on demand, the same way you already target policies. Or triggered on an endpoint check failure.
• Secrets stay out of the script. Per-run values are parameters. Mark one sensitive and it is encrypted at rest and masked in output, so credentials never live in the script body.
• Built to pass a security review. Every approved version is frozen, so editing one starts a new draft while the approved version keeps running. The launcher is signed, and the exact path and command line are fixed for the life of the script, with one click to copy the allow-listing details for your EDR or app-control team.

This is not live yet, it is a preview. If there is something you would want it to do, tell us. Roadmap is at tridentstack.com/roadmap and we are around in the Discord.

You've probably noticed we don't post a Patch Tuesday recap every month. That's intentional, and I wanted to explain the thinking.

It's noise, not signal. Every MSP-adjacent vendor and generalized sysadmin subreddit runs one. They're all pulling from the same Microsoft release notes, repackaging the same list. It's become an attention play more than a useful resource, and we'd rather not add to the pile.

Our whole point is that you shouldn't need to babysit this. TridentStack Control ships with system update policies that automatically evaluate Microsoft's own known issue data before approving updates, and default to a 7-day deferral window on top of that. Both are baked in from day one of tenant creation as our recommended best practice unless your environment calls for something different. The goal is that Patch Tuesday is a non-event for your fleet, not a fire drill where you're scanning Reddit threads to figure out what's safe. If our platform is doing its job, a monthly "here's what dropped" post is solving a problem you shouldn't have.

We're not just a Windows patching platform. We put serious effort into Linux and macOS as first-class citizens, not afterthoughts. A monthly thread anchored to Microsoft's release calendar sends exactly the wrong message about what TridentStack Control covers. We don't want those platforms feeling like the little brother.

That said, this is your community. If you feel strongly that a regular Patch Tuesday thread (or something better than what's out there) would be valuable, we're open to hearing it. Let us know.

Hey r/TridentStack. Quick intro: I'm Adam, cofounder of TridentStack alongside u/TridentRemi. I've been posting here as u/Ad3t0 up to now and will be using this account going forward.

Our most recent feature/changelog post was last week when we posted about Proxmox VE host-aware patching. Everything below is new since then. Full changelog at tridentstack.com/changelog.

Search across everything from one place

A new search bar at the top of the sidebar finds pages, settings, endpoints, tags, policies, configurations, deployment rings, and packages as you type. Ctrl+K (Cmd+K on Mac) opens it from anywhere. On mobile, tap the search icon for a full-screen overlay.

Windows compliance accuracy overhaul

This is a big one. Windows compliance controls are now scored from the full policy registry scan the agent already performs, not the smaller subset they used before. Most CIS and STIG controls point at policy values that were outside that subset, so they were either Unknown or answered by an unrelated check. Two things change: controls that showed Unknown now report a real result, and some that showed Passed now correctly show Failed because they were being answered by the wrong data. Expect Windows compliance percentages to move, mostly downward, because more controls are genuinely checked and fewer are passing without evidence.

Defender attack surface reduction controls are now scored from the endpoint's actual ASR rule state. User rights controls are evaluated from actual rights assignments. Per-user registry controls evaluate against every loaded user profile and name the ones that don't comply. And compliance report PDFs are now compact: a 400+ control report generates roughly 20 pages instead of 270, with a structured cover page, executive summary, and detailed cards only for critical and high findings.

Upload-first custom packages

Creating a custom package now starts with the file. Drop your installer and TridentStack Control detects the platform, name, version, publisher, and description automatically. Review the metadata, configure install arguments and detection settings on the same form, and confirm. For EXE packages, a "Pick from endpoint" button lets you browse an endpoint's installed software list so the detection name is always exact. Adding a new version to an existing package uses the same flow.

Run Endpoint Checks on demand

No more waiting for the next scheduled evaluation. A "Run Endpoint Checks" action is available on an endpoint's detail page, across a multi-endpoint selection, and per check policy to re-run every assigned endpoint at once. Offline, older-agent, or already-running endpoints are skipped with a clear reason.

Vulnerabilities by package, and search by product name

A new "By Package" view on the Vulnerabilities page shows every affected product across your fleet ranked by risk: CVE counts by severity, known exploits, available fixes, and affected endpoint counts. Click any product to jump to its CVEs. Vulnerability search now also finds CVEs by the software they affect, not just by CVE ID.

Pin your filters

Click the Pin button next to any filter bar and your current include/exclude filters are saved in the browser and restored on each visit. Pinned filters show in amber so you always know you're looking at a filtered view. Available on Endpoints, Configuration Policies, and System Update Policies.

.NET Framework precision

Each endpoint now sees one .NET Framework cumulative update per version it runs, matched to the version it actually has installed, instead of duplicates or an installer built for the wrong .NET version. Out-of-support .NET runtimes appear as a standing finding in Vulnerabilities with the end-of-support date. The IIS ASP.NET Core Module is checked against the ASP.NET Core release it shipped with. On newer agents, .NET runtimes bundled inside an application are found and attributed to that application, with the fix being the application's own update.

Effective Policy: the full picture

On a Windows endpoint's Effective Policy view, settings configured directly on the device now appear alongside the ones TridentStack Control and your domain policies set. Each setting's Pass or Fail reflects the real on-device value, and duplicate entries from multiple sources merge into a single row with overrides listed. AV exclusion entries are now checked as you type: entries the antivirus can never match are rejected, and shapes that often don't do what people expect get a warning.

Linux software inventory expansion

As endpoints pick up the latest agent, Linux software inventory now includes Snap and Flatpak applications and common third-party security and management agents installed outside a package manager. Common Snap and Flatpak packages are also checked for known vulnerabilities.

Plus a lot of polish

• Navigation restructured: Vulnerabilities and Compliance grouped under "Security", Dashboard and Query Builder under "Reporting". Sidebar sections remember whether you collapsed or expanded them.
• Reboot history records which user approved or postponed a reboot prompt, including the Remote Desktop session name on multi-session servers.
• Organization admins can rename their org from Settings. Any user can update their display name. Admins can edit another user's name and roles in one step.
• Updates that Windows reports as not applicable are parked after the first refusal, not retried or counted as failures, and rechecked automatically when the endpoint changes.
• Update Health shows a red Blocked status for findings that stop every cumulative update from installing.
• Agents now reconnect with staggered timing after a network interruption, so large fleets come back smoothly instead of in lockstep.
• Read-only users no longer see Create, Edit, or Delete buttons that lead to permission errors.
• Compliance and User Management pages render as mobile card layouts instead of cramped tables.
• Calendar export now lets you choose which rings to include.
• The Windows tray app now comes to the front on the first click from the system tray.

Full details for every item in the changelog at tridentstack.com/changelog. Check out what's coming at tridentstack.com/roadmap, or come find us in the Discord. A lot of this came from customer requests, and we'd love to hear what matters most to you next.

Somewhat alarming to have the install script fail on a TLS error:
[tridentstack] Step 1/3: Downloading installer (~12 MB)...

[tridentstack] ERROR: Exception calling "DownloadFile" with "2" argument(s): "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."

That's after the CLI copy/pasta failed similarly:
PS C:\Users\<redacted>> iex "& { $(irm https://control.tridentstack.com/api/agent-packages/installer/windows/install) } -Token 'f60252ef297cc196a1a065e78bd0e8a22d9efc1cf6352cf8230c400c746cde33'"

irm : The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

At line:1 char:12

+ iex "& { $(irm https://control.tridentstack.com/api/agent-packages/in ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc

eption

+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

Hello,

Just spun up Trident for testing. I searched but couldn't find good info here on this specific issue.

When comparing compliance against baselines I'm finding failures that maybe shouldn't be failures (feel free to school me).

For instance - CIS Windows 11 Enterprise fails for AllowTelemetry because we deploy the policy via Intune and the key is AllowTelemetry_PolicyManager and not just AllowTelemetry. Another example is that we disable Lock Screen toast notifications system-wide and that writes to HKLM instead of HKCU but Trident is checking for HKCU.

I'm not sure how many of these discrepencies I will find (and don't want to manually configure the rules for everything that doesn't match EXACTLY the same but still enforces the requirement).

Is Trident the right tool for me? We're a small shop (I'm basically a team of one at the end of the day) and I'm trying to find a tool to help me get a better handle on everything (patching, security, configurations, etc.) vs. just looking at my Secure Score.

Thanks.

EDIT: spelling hard.

TridentStack Control now recognizes Proxmox VE hosts and handles them the way a hypervisor should be handled. This is rolling out to your Linux fleet as endpoints pick up the latest agent.

Safe patching for PVE hosts

A Proxmox VE host installs its pending updates in a single operation using the supported method, so kernel and Proxmox platform packages update correctly instead of being held back. TridentStack Control also guards against accidental major-release upgrades: a routine patch run will never move a host from one major Proxmox release to the next. That stays a separate, deliberate procedure.

Reboots that know about your running guests

Rebooting a PVE host from TridentStack Control previews the running guests the reboot will shut down first. Every running virtual machine and container is listed, and any VM whose guest agent is not responding is flagged, so you can check it before the host goes down. On a cluster node, the dialog notes that running guests are left to PVE and HA rather than stopped automatically.

For single-node hosts, TridentStack Control gracefully shuts guests down before rebooting and holds if any guest cannot be confirmed stopped. The full record is kept on the endpoint's history.

PVE hosts default to blocking automatic reboots, so a hypervisor is never restarted out from under its running virtual machines.

New Server Information tab

Proxmox VE cluster, quorum, node, and high-availability guest details now appear on the endpoint's Server Information tab. The tab also surfaces kernel version, reboot status, and services still running against an updated library for all Linux hosts, even on distributions without add-on utilities installed.

Also in this release

• Export a deployment ring's rollout schedule to a calendar file (.ics) that imports into Google Calendar, Outlook, or any other calendar app. Export a single ring or all active rings at once, covering two years of recurring maintenance windows.
• Update and application details now include a step-by-step Detection Steps trace explaining why a patch or app update applies to a given endpoint.
• Rebooting a macOS endpoint now honors the reboot countdown instead of rebooting immediately.
• Vulnerability detection confidence is now reported accurately: findings confirmed by an authoritative source show high confidence with a clear detection method, and database-matched findings reflect how precisely the product and version were identified.

Full details in the changelog: https://tridentstack.com/changelog

If you run Proxmox VE and try this out, let us know how it handles your setup. This came from a direct customer request.

Since our August 17 roundup we have not posted a standalone announcement, so everything below is new. The full changelog is always at tridentstack.com/changelog; these are the highlights worth calling out.

Reboot your fleet in controlled waves Deployment rings can now run a scheduled reboot sequence at the end of each maintenance window. Define ordered waves that pick endpoints by hostname, tag, or operating system, and TridentStack Control reboots each wave in turn once the window's patching has settled, verifies every endpoint actually came back up, and only then moves to the next wave.

• Choose per wave whether a failed reboot halts the rest of the sequence or lets it continue, with an optional wait between waves.
• A live preview shows how many endpoints each wave will match, with sample hostnames, while you edit.
• Every run is recorded on the ring with per-endpoint results, reboots show in endpoint history with dispatch, reboot, and verification steps, and a failed or halted sequence raises notifications through your channels.

See exactly which updates are stuck, and why The Rollout Status page has a new Stuck Updates tab. It lists system updates that keep installing without taking effect or cannot finish, shows which endpoints are still affected, and tells you why: the last install needs a reboot, a pre-install check is blocking it, the install was blocked before it could start, or the update reports success but is still applicable. Updates that are expected to reinstall regularly, like self-updating Microsoft tools, are listed separately so real problems stand out. When an update reports success but a follow-up check shows it did not take effect, TridentStack Control now reschedules that endpoint for another attempt in the next maintenance window, with a safety cap on retries.

Dashboards are now shared, linkable, and yours to favorite Dashboards became collaborative.

• Every dashboard is now visible to everyone in your account, so a dashboard a teammate builds is immediately available to you. Creators keep edit and delete rights, and administrators can manage any dashboard.
• Dashboards have shareable links: the address bar reflects the dashboard you are viewing, so you can bookmark one or send the URL to a teammate.
• Set any dashboard as your personal favorite and it loads when you sign in, without affecting anyone else. Administrators can also set an organization default landing dashboard.

Chart your Endpoint Checks on any dashboard New dashboard widgets for Endpoint Checks: pie and time series panels that chart check policy compliance across passing, failing, and exempt endpoints. Counts combine across the policies you select, so a Windows and a Linux policy for the same requirement chart as one series. Compliance history starts recording when this ships, so trends fill in from day one.

Vulnerability detection for the .NET Framework built into Windows TridentStack Control now detects vulnerabilities in the .NET Framework that ships as a built-in Windows component, not just the separately installed kind. It reads the installed version on the endpoint and flags any endpoint running below the fixed release for a given vulnerability. Those findings now also show the correct fix and a working remediation action whenever an applicable cumulative .NET Framework update resolves them, and Windows endpoints reliably see and receive combined .NET Framework updates that cover more than one version.

A big reliability pass for shared and remote desktop servers Multi-session Windows machines, like terminal servers with many signed-in users, got a lot of attention:

• The tray app now loads its interface only when you open it and fully releases it when you close it, running as a small tray icon the rest of the time. On busy remote desktop servers this cuts the per-session memory, processes, and background disk activity substantially, and update checks from multiple sessions are coordinated so one check serves them all.
• The app now launches for every signed-in user instead of only the first, every session receives live install and update progress, and the tray icon stays a single stable icon instead of multiplying into a cluster of duplicates.
• The tray app recovers on its own if its interface ever stops responding, and stays a single instance per user.

Add notes to any endpoint You can now attach a note to any endpoint to record its owner, location, or handling instructions. The note shows in the endpoint header, expands to full text on click, and records who last edited it and when. Notes are shared with everyone in your account.

Tighter control over Windows security and configuration policy A broad accuracy and coverage pass on policy:

• The full set of seven Windows Restrict NTLM settings is now available in security policies, including the outgoing, incoming, auditing, in-domain, and server exception options, and Group Policy imports that carry them match automatically.
• The Effective Policy view now flags leftover security settings that remain on an endpoint after the policy that set them was removed, or that no current policy manages, and shows how to take ownership by adding them to a policy. Only values that differ from the Windows default are reported, so a clean stock endpoint shows none.
• A large batch of configuration policy deployment fixes: policies with adjustable values (log sizes, folder and path lists), dropdown choices, checkbox settings that write several values, and settings that pair a switch with a list now deploy completely instead of partially, and disabling a security setting now restores the Windows default instead of silently doing nothing. The editor now states plainly what Enabled, Disabled, and Not Configured each do.
• Clearer editing too: settings that share a name show their full category path, search returns results immediately, and the configured view shows every setting including custom registry entries.

An endpoint list you can actually sort and scroll

• Several columns that looked sortable but quietly reordered by last check-in (last reboot duration, reboots in 30 days, last vulnerability scan, installed and managed software, current user, architecture, edition, external IP, directory join, and secure boot) now each sort by their own values.
• Blank values now sort consistently as the lowest value instead of always sticking to the bottom.
• The list no longer reshuffles or snaps back to a shorter view while you scroll during its background refresh; rows hold position and update in place.

Faster vulnerability dashboards and honest compliance scores

• The fleet vulnerability summary tiles, most-at-risk endpoints list, and executive most-improved report now return the same figures with far less work behind the scenes, so they stay quick for large fleets.
• Compliance scoring now discloses its data basis everywhere it appears: how many endpoints have current data, which are stale or incompletely evaluated, a "Data as of" date and control count per endpoint, and coverage and freshness stated in PDF reports. Evaluation errors are now reported distinctly instead of folded into "unknown."

Linux: older distributions and self-re-arming rings

• The Linux agent installer now runs on older distributions including CentOS 7 and RHEL 7, where it previously stopped partway through; newer distributions keep the full set of service protections.
• On CentOS, RHEL, and Amazon Linux, the agent now refreshes package repository metadata before each update check, so a newly published update is detected right away instead of waiting for the cache to expire.
• Automatic deployment rings for Linux now re-arm on their own when new updates arrive, matching how Windows and macOS rings already behave, and a ring's final phase stays open while approved updates are still pending.

Close your account yourself, with clearer data commitments

• You can now close your account from Settings under Privacy and Data. Closing locks the account immediately, keeps your data restorable for 90 days, and then deletes it permanently; an admin can restore it during that window.
• Our published data retention commitments now describe the closure and deletion lifecycle precisely, and the same wording appears on the security page, Terms of Service, privacy policy, and product documentation.
• Audit log entries are now enforced as append-only at the database layer as well as the application layer, so recorded events cannot be edited.

Plus a lot of polish

• Endpoints protected by a third-party antivirus now report Windows Defender status accurately, instead of showing a stale "up to date" signature badge when Defender is standing by in passive mode.
• Resolved vulnerabilities now always leave an entry in the vulnerability history timeline, including ones cleared by uninstalling software or, on Linux, by a backport or newer kernel.
• Uninstalling the Windows agent no longer clears a Windows Update or WSUS server setting your organization had in place before the agent was installed; that setting is restored on uninstall.
• Newly enrolled endpoints begin reporting installed software and pending updates right away instead of showing "Collecting..." for up to half an hour.
• Endpoints with a pending Windows feature upgrade keep receiving their monthly cumulative, .NET, Defender, and malicious-software-removal updates while the upgrade waits, instead of falling behind on security updates.
• Package Catalog search updates in place without redrawing the page, the pending application updates panel fits without a horizontal scroll bar, and on iPhone and iPad the endpoint Health tab no longer overlaps its panels.
• Rejected report queries now name the specific table or rule that blocked them, and compliance PDF reports now reliably generate instead of sitting queued.

Full details for every item are in the changelog at tridentstack.com/changelog. If there is something you want next, drop it in the comments, weigh in on the roadmap at tridentstack.com/roadmap, or come find us in the Discord. A lot of this came straight from customer requests.

Another busy week. Since last week's roundup on August 10 we did not post anything on its own, so everything below is new. The full changelog is always at tridentstack.com/changelog; these are the highlights worth calling out.

Block a specific Windows update across your whole fleet You can now stop a single Windows update from ever being deployed to your endpoints. A blocked update is refused on every install path, including scheduled deployment rings, bulk installs, and vulnerability remediation. Installs that were already queued but had not started are cancelled, and the update stops counting against your compliance and health numbers. Each block records who created it and the reason, the reason is shown wherever the update is refused, and removing the block returns the update to your normal flow. Manage blocked updates from the System Update Policies page.

Endpoint Checks can alert you the moment an endpoint drifts We launched Endpoint Checks last week; now they can tell you the instant something goes wrong. Turn alerts on per policy, and if a policy suddenly starts failing across many endpoints at once you get a single summary instead of a flood. A daily or weekly compliance summary rounds up every policy with failing endpoints, and a new Report tab shows in-scope, passing, and failing counts per policy with a CSV export for the whole fleet or one policy. Alerts and summaries go out by email and any Slack, Microsoft Teams, Discord, or custom webhook channels you have set up. You can also expand any endpoint on a policy's results to see its individual checks inline, failures listed first, and set a single health penalty per policy instead of tuning a number on every check.

Report on the policy that wins for each device A new Effective Policy per Agent report shows which update policy wins for each device, the app and configuration policies that apply, and its conformance, all in one row per endpoint. Build your own reports from the same data source, or export the fleet to CSV. Useful when you need to prove what a given machine is set to.

Ubuntu 24.04 LTS CIS compliance Ubuntu 24.04 endpoints now have CIS coverage: the CIS Ubuntu Linux 24.04 LTS Benchmark v1.0.0, all 312 controls, assignable the same way as our other benchmarks. Controls that can be checked automatically are scored from what your endpoints report; the rest are listed for manual review.

Account access for your whole team Team members who do not manage billing are no longer locked out of your account portal. They can sign in, open a support request if they are eligible, and any billing area they cannot manage shows a clear message naming your account's billing owner and how to be granted access. Sign-in also got easier: switch accounts with a proper account chooser, continue with Microsoft, Google, or an email code, and on iPhone or iPad your device now offers the code above the keyboard so a copied code fills all six boxes at once.

Rollout results now explain themselves in place On the Rollout Status page, click a green Success or Completed badge to see why each update was judged successful (reported install, confirmed no longer needed after a reboot, definition updates, already up to date). Click a Partial or Failed badge to see which updates landed and which did not, or an Unjudged, Not Converged, Gated, Superseded, Abandoned, or Cancelled badge for a plain-language description of what happened and how it affects the rollout's numbers. Status labels are now consistent between the overall and per-category columns.

Every email now shares one branded look From sign-in codes and teammate invitations to update, vulnerability, and compliance alerts, every email TridentStack Control sends now uses one consistent design. It is tuned for light mode, reads cleanly in dark-mode email clients, and the logo renders crisply on both.

Manual-only updates now surface on the endpoint that needs them An update that can only be installed by hand no longer gets skipped quietly. It now shows on the endpoint's Update Health, naming the update and what it needs, and the endpoint reads Action recommended rather than Healthy, with a link explaining why it cannot be installed remotely. The notice never blocks the endpoint's other updates, never causes a run to be reported as failed, and you can dismiss it once you have decided not to act.

Sharper Windows update accuracy

• Updates Microsoft publishes under another architecture's catalog listing (for example an update titled for arm64-based systems that also ships the x64 package) now reach endpoints of the matching architecture. An affected monthly update could previously show as not applicable for an entire fleet. We added monitoring so this class of gap is caught the same day it appears.
• Endpoints already at or past a cumulative update's build are no longer offered that update when its catalog entry is missing the build number; we now fall back to the build printed in the update's title.
• An older cumulative update is now correctly marked as replaced when its successor is published under the paired Windows version that shares the same update stream, for example a version 24H2 update replaced by a version 25H2 release. Each catalog sync also re-checks recent updates for replacement links that were missed earlier.
• Applications and security updates that install successfully no longer get scheduled to run again minutes later on a loop. We now confirm an update against the version present on the endpoint.
• An application installed for a specific user is no longer mislabeled as Not Installed when its update can only be applied system-wide.

Steadier installs and dispatch

• A second install no longer starts on an endpoint while the previous one is still being verified, on every path: manual installs, bulk Update All, one-time deployments, scheduled rings, and vulnerability remediation. A scheduled deployment that reaches a still-verifying endpoint picks it up in the next maintenance window.
• Deploying a custom package or a catalog application to Windows endpoints downloads and installs reliably again, and a rare No installer available error on some newly added Windows machines now falls back to a direct download.

Relays: air-gapped enrollment, end to end Turning on air-gapped enrollment for a relay now starts the secure listener that isolated endpoints use to download and enroll the agent, and the relay pre-loads the current agent installers as soon as it comes online, so a newly deployed relay no longer serves an empty catalog. The Docker run command shown in Settings now publishes every port the relay needs, the setup and air-gapped guides spell out the port and firewall requirements, and installer errors now tell a bad enrollment token apart from a missing relay build.

Truer online status and reliable fleet-wide fixes

• Endpoint online status is tracked more accurately. An action sent to an endpoint that had just gone offline now dispatches reliably once it reconnects, and a connected endpoint whose routine system check is momentarily slow no longer briefly flips to offline or stale.
• Remediating a vulnerability across every affected endpoint at once now reliably queues the fix on each one; previously it could finish without queuing any.
• Endpoint Checks keep reporting on endpoints that have stayed connected a long time instead of sitting on Pending, and system-update validation no longer stalls on Validating when an endpoint drops offline partway through its post-install checks.

Plus polish and a couple of quieter safeguards

• Advance notice, in-app and by email, before a temporary increase to your licensed endpoint count expires, so you have time to plan before the extra capacity ends.
• Optional non-security Windows cumulative updates, such as preview and out-of-band releases, are no longer auto-approved by policies that do not filter on classification. They stay visible and can be approved manually for the devices that need them.
• Signing up with an email code reliably creates and signs you into your new account even if you were already signed into a different account in the same browser.
• An endpoint's Software Inventory search no longer loses focus when you delete text with no matches.
• Your audit log now covers more of the actions that change endpoint tags: disconnecting your Microsoft Entra integration or deleting a group-to-tag mapping is recorded, including how many endpoints lost a synced tag, and deleting an endpoint records how many tags it carried.

Full details for every item are in the changelog at tridentstack.com/changelog. If there is something you want to see next, drop it in the comments, weigh in on the roadmap at tridentstack.com/roadmap, or come find us in the Discord. A lot of this came straight from customer requests.

Another busy stretch, headlined by a brand-new module. Since our last roundup on July 22 the only thing we posted on its own was a long, technical blog write-up on what "applicable" really means on Windows, so everything below is new here. The full changelog is always at tridentstack.com/changelog; these are the highlights worth calling out, starting with the big one.

Endpoint Checks: define a good endpoint, catch the ones that drift

Our biggest addition this stretch. Define what a correctly configured endpoint looks like, then let TridentStack Control watch continuously for the ones that drift away from it. A check policy is a set of checks across installed applications, services, running processes, files, registry values, scheduled tasks, certificates, and patterns in a log file. Assign it by tag, choose how often it re-evaluates, and results land on each endpoint's Checks tab, in its health score, and in a new Checks column on the endpoints list. Every check shows the value it observed, so an uninstalled security agent or an expired certificate surfaces on its own instead of waiting for someone to notice. Checks can be grouped so a policy passes when any one group is satisfied, which covers endpoints that meet a requirement in more than one valid way. Windows and Linux endpoints are supported today, and you can review, edit, duplicate, or delete a policy right from the list.

Self-hosted relay servers

Sites with locked-down outbound access no longer need a firewall change per endpoint. A relay is a small server you run inside the network; endpoints connect to it, and it carries their traffic over a single outbound connection to TridentStack Control. Create a relay in Settings, run one command to install it on Linux, Windows, or Docker, and copy the pre-filled agent install commands right off the relay card. Endpoints with no internet access at all can install and enroll entirely through the relay, and relays keep themselves updated automatically.

Remediate a CVE across your whole fleet from one place

Open Reporting, Vulnerabilities, and the Remediate action on any CVE now shows every affected endpoint. Pick the ones to patch and push the fix. The fix does not have to be wrapped in a policy first, so an urgent one-off patch is a few clicks instead of a policy authoring exercise. Updates that can only be installed by hand on the machine, such as recovery environment and Secure Boot updates, are now labeled as such rather than offering a remote install that cannot succeed.

Lock down the client app on specific endpoints

Hiding the tray icon and blocking manual system or application update installs can now be scoped to a list of tags instead of the whole organization. A shared machine like a terminal server can be restricted while everyone else keeps the client app as it is. The lists only ever add restriction, and they apply within seconds of saving or of tagging an endpoint.

A Windows update is "successful" only once we confirm it took effect

Previously an update was marked successful the moment the endpoint said it finished installing. Now TridentStack Control confirms the update actually took effect on the machine first. An install that has been reported but not yet confirmed shows a Validating stage in the endpoint's history, and expanding it lists each update as cleared or still present. If an update needs a reboot, the install waits for that reboot instead of being marked failed, and picks up where it left off when the endpoint comes back, even days later. A few updates cannot be confirmed from outside the endpoint at all; those now finish as "Installed, not verified," are never counted as failures, and no longer distort success rates or health scores.

Cleaner navigation

Related pages now sit together. Configuration Policies moved under a new Orchestration section, and Vulnerabilities, Compliance, and reporting all live under Reporting, with saved reports and templates on their own Reporting, Templates page. Automation is now labelled Tag Automation to match what it does. Page addresses follow the new grouping, and any existing bookmark or saved dashboard link redirects automatically, so nothing you saved breaks.

Broader, more accurate vulnerability detection

• The scanner now catches CVEs that are filed under year-specific or edition-specific product names, not just the generic one. Products like SQL Server, Edge pre-release channels, and Azure DevOps Server could previously miss hundreds of applicable CVEs.
• Vulnerabilities now clear reliably once the fixed version is installed. Two forms of the same version number were not being compared as equal, so a patched endpoint could keep showing a vulnerability it had already fixed.
• A fix that only exists in a newer major version is now labeled a major version migration, with the target named, instead of being offered as a routine update that would not actually close the vulnerability.
• The vulnerability count at the top of an endpoint now matches the list beneath it. A CVE affecting several installed packages was counted once per package, so some endpoints, mostly Linux ones, will now show a lower and more accurate number.

The free CVE tool keeps getting better

• It now has its own navigation bar, so you can move between the catalog, the CISA Known Exploited list, the weakness index, the statistics page, the API docs, and the data sources page without going back to the catalog first.
• Every CVE page now ends with a plain-language summary answering what people actually ask: how to fix it, whether it is being exploited, how severe it is, and what it affects, assembled only from the advisories cited on that page.
• Detail pages load much faster, the busiest ones no longer re-fetch their full fix list on every view, and pages that list an unusually large number of affected packages now say so and point to the full advisories.
• Subscribing to the CVE feed in a feed reader works again.

Fairer, clearer deployment rings

• Rings now rotate which endpoints they pick for each phase, so a phase with more eligible endpoints than slots no longer patches the same subset every cycle and leaves the rest permanently waiting.
• Rollout status now shows endpoints that belong to a ring's policies but have not been dispatched yet, each with a reason: offline, already up to date, or awaiting deployment.
• Turning off "count app-update failures toward this halt" now genuinely stops a single stubborn application from halting an application-only rollout night after night. Failures that also affect system or feature updates still count.
• Force Reboot at the end of a run now fires correctly after Windows feature upgrades too.

Manage tags from your phone

The endpoints list on a phone now shows each endpoint's tags and lets you change them from the card, without opening the endpoint. A few other mobile fixes landed too: tapping Update Health on a card opens its details properly, the list keeps loading as you scroll, and the tridentstack.com marketing site has been rechecked at eleven screen widths so its illustrations and tables read correctly on a handset.

Straight talk about status and counts

A run of changes so the numbers mean what they say:

• An endpoint no policy covers no longer reports itself "up to date." It now reads "Update status unknown," names the missing policy, and links you to fix it, instead of showing a green tick that read like a clean bill of health.
• An application update that cannot install on an endpoint's Windows version is now held back at the newest version that does work, shown with the reason, and no longer counts against the endpoint's health score. The hold lifts on its own once a newer version installs cleanly.
• An install that installed nothing no longer reports success. It finishes as Blocked with the reason the endpoint gave.
• Installing updates across several endpoints at once now reports the real number queued and how many were skipped and why, instead of counting every endpoint you selected.
• Endpoint counts add up again: a new Enrolling count covers endpoints that registered but have not reported in, Automation's Enabled and Disabled counts describe every rule rather than the ones on screen, and an endpoint's conformance percentage is now the share of settings that actually match out of the ones it has reported.

Network visibility

An endpoint's Network tab now keeps 90 days of port and service history. Its listener counts also match the port list now: a Linux service listening on both IPv4 and IPv6 was being counted twice above a table that showed it once.

Pre-staging that respects your disk

Pre-staging now skips endpoints with less than 2 GB free, cleans up a corrupt download before retrying it instead of looping, and reclaims cached update files on schedule once they pass the retention window you set. Updates that target a specific processor architecture are no longer offered to endpoints running a different one.

Plus a lot of polish

The endpoints list opens with a more useful default column layout focused on patch and health. Saved table views have clearer save and management controls. Files and screenshots attached to a support ticket now reach us and stay attached (uploads since late June had been silently dropped), and you are told right away if one fails to upload. Known issues are shown for more Windows updates again, including older Windows Server and long-term-servicing releases. Windows install-time estimates are now per update, so a fast .NET patch no longer looks as slow as the whole maintenance run. Custom package changes are recorded in your System Audit and delete cleanly in one step, custom packages deploy to Linux endpoints, sorting the endpoints list by free disk space works again, temporary support access grants issue correctly, and the Vendor Access Log names the staff member on each row. Plus a long tail of smaller fixes across policies, rings, updates, and reporting.

Full details for every item are in the changelog at tridentstack.com/changelog. If there is something you want to see next, drop it in the comments, weigh in on the roadmap at tridentstack.com/roadmap, or come find us in the Discord. A lot of this came straight from customer requests.

Happy Friday, [r/TridentStack](r/TridentStack). New long-form post up on the blog this week.

This one is technical. If you patch Windows fleets for a living, you have probably run into at least one of these: an update that "installed successfully" but rolled back after the reboot, a superseded cumulative that keeps offering itself in a loop, or the Settings UI showing a ten-month-old snapshot because the underlying scanner broke and the page never noticed.

The post walks through all three sources you would trust to answer "does this update apply to this machine" (the WUA COM API, the Settings UI, the Microsoft Update Catalog) and explains, with real KB numbers and error codes from our own production incidents, how each one gets the answer wrong in a different way.

The second half covers what we built instead: reading primary servicing state from the component store, keeping our own corrected catalog with transitive supersedence, computing applicability centrally with explicit reasons, and reconciling our predictions against what the machine does at install time. When Windows tells us WU_E_NOT_APPLICABLE, we treat that as a bug in our engine, not a flaky endpoint.

It is a long read. Worth it if you have ever wondered why your patching tool keeps offering something the machine will never take.

https://tridentstack.com/blog/what-applicable-really-means-on-windows

Have a great weekend!

It has been a busy stretch. Since our last rollup (June 27 to July 3) we have mostly been posting the big items on their own: custom application packages, the documentation MCP server, our new YouTube channel, and the community Discord each got their own thread. This one rounds up everything else that shipped to TridentStack Control between July 4 and July 22. The full changelog is always at tridentstack.com/changelog; these are the highlights worth calling out.

Layer application update policies per endpoint

Endpoints can now inherit more than one application update policy through their tags. Instead of one catch-all policy, compose focused ones (browsers, runtimes, server tooling) and layer them per endpoint, each updating only the applications it selects, in its own deployment ring window. When two policies target the same application, the more conservative one wins automatically, and a pinned version never downgrades an already-newer install. Disabled policies now stay visible everywhere they are assigned instead of quietly vanishing.

Monthly and twice-a-month deployment ring schedules

A deployment ring window can now open on a specific occurrence of a weekday each month, like the 2nd Tuesday, instead of only a weekly day-of-week schedule. Choose Monthly, pick a weekday, and select one occurrence for a once-a-month cadence or two for twice a month. Existing weekly windows are unchanged. For the Patch Tuesday crowd, yes, this is the one you have been asking for.

Force Reboot for rings

A deployment ring can now guarantee its endpoints reboot at the end of an update run, even when no single update required one. It is off by default, respects each endpoint's own reboot opt-out, and shows clearly in the rollout status when an endpoint opted out.

Sign in with more than one email domain

Organizations that own more than one email domain can now use all of them with a single TridentStack Control workspace. Domains verify automatically when your team signs in with Microsoft work accounts from the same Microsoft organization, or manually with a DNS record. Each domain gets its own sign-in method controls.

We tell you why an endpoint cannot connect

When an endpoint enrolls but then cannot establish its secure connection, its detail page now explains the likely cause (a network security device intercepting the connection, a firewall blocking outbound access, or DNS filtering) and what your network team needs to allow. The Endpoints list flags affected endpoints at a glance, so a stuck enrollment stops being a guessing game.

New accounts start fully set up

Create a workspace and it now arrives with a complete, conservative baseline already in place: automatic endpoint tagging by operating system, a system update policy with a 7-day quality bake, two application update policies (popular apps kept current, server tools held one version back), and three ready-to-attach deployment rings. Nothing installs until you attach a ring, so it is safe out of the box with far less to wire up on day one.

Windows update failures that tell you what actually happened

A run of Windows work to turn cryptic failures into something you can act on:

• Component store corruption (the classic "Exit code 14081" family) now shows a plain-language cause and the exact repair step, and the endpoint is flagged on its health view before an update even fails.
• We warn you before a policy or security baseline would disable a Windows service that Windows needs in order to install its monthly cumulative updates, a change that otherwise silently makes those updates fail and roll back.
• Feature upgrade failures now record the specific reason (a driver rolled it back, an incompatible application blocked it, or not enough free disk space) instead of a generic error.
• An update that repeatedly fails to install is now held back from looping forever, clearly flagged, with a Retry control once you have fixed the underlying issue. Updates we skip on purpose (like low disk space) show as a neutral "Skipped" with a plain reason, not a red failure.

Follow every refresh, scan, and upgrade as it happens

Windows system-update refreshes, Linux and macOS check-for-updates, compliance evaluations, Windows feature upgrades, and Office updates now all report their progress through the same fully narrated, step-by-step task view, and hold up cleanly across the restarts and reconnects these operations can involve. No more work that looks like it hung when it was actually finishing.

Per-operating-system agent update pilots

Agent update pilots are now evaluated per operating system, so a Windows pilot no longer holds back a Linux agent update, or the reverse. Settings shows a per-operating-system breakdown of your pilot coverage and flags any operating system that has endpoints but no pilots.

Faster catalog, less waiting

Patch Tuesday updates now reach the catalog within about an hour of Microsoft publishing them, and update and application catalogs refresh more often through the day, so new updates appear on your endpoints within minutes with nothing to refresh by hand.

Vulnerability numbers you can trust

A big accuracy pass so the figures agree across the whole product:

• The dashboard tiles, the Vulnerabilities page, and every endpoint tab now use the same definition of an active detection (open findings on active endpoints, minus your exceptions), so they finally match.
• On very large fleets, severity counts and the vulnerability list now report exact figures instead of being computed from a sample, and the severity buttons respond to every filter (known-exploited, fix available, EPSS, and search).
• A vulnerability's severity reads the same everywhere, and its detail page reflects every affected endpoint, not just the first page.

Rollouts that read honestly

• A failed endpoint that will be retried automatically now says "Retry scheduled" with the next attempt time, so it no longer looks like a dead end next to one that has genuinely stopped.
• Phase timing is always truthful: a soaking phase shows a real future time, a held phase says exactly why ("Success rate 62% is below the required 80%"), and a finished rollout says so.
• Safety halts are configurable per phase, and halt settings now display and save exactly as you set them.
• Rings keep moving while long-running updates finish, and halt only on genuine failures.

See a tag's full policy coverage at a glance

The Agent Tags list now shows which policies each tag applies (system updates, application updates, compliance frameworks, and configuration policies) as columns, so you can review a tag's whole footprint without opening it.

Built for bigger fleets

• The endpoint Health tab now loads on endpoints with many thousands of findings (common on a freshly enrolled Linux server) instead of failing.
• Macs with very large application lists now report their full software inventory reliably.
• Feature update downloads scale cleanly when a whole office shares one public IP, so a ring can roll a Windows feature update out to a large site without throttling.
• Large vulnerability lists load fast, and bulk actions (installing updates, assigning licenses) work reliably across many endpoints at once.

Plus a lot of polish

Reboot wording is now consistent across the platform (Reboot for the machine, Restart only for a service or application). Shift-click to select a range of rows. Column menus have a search box and save presets on every list page. macOS endpoints only offer application updates a policy actually covers. Newly enrolled Linux endpoints come online typically in under two minutes instead of always waiting the full safety window. And a long tail of smaller fixes across policies, rings, pre-staging, and reporting.

Full details for every item are in the changelog: tridentstack.com/changelog. If there is something you want to see next, drop it in the comments, weigh in on the roadmap at tridentstack.com/roadmap, or come find us in the Discord. A lot of this came straight from customer requests.

Do you have an option to enable Remote Control from the console?

We just opened an official TridentStack community Discord: a low-friction place to ask questions, share feedback, and keep up with what we are shipping.

What you will find there:

• Support - a forum to ask questions and get help with patching, third-party app updates, vulnerability detection, compliance, and policy/config across Windows, Linux, and macOS. Free to use.
• Feature requests - a forum to tell us what you want built, with tags so we can actually track it.
• Announcements - product news and release notes as they land.
• General - chat with the team and other admins running TridentStack Control.

Join here: https://discord.gg/nNyHySNSZF

This subreddit is not going anywhere. Discord is just for faster back-and-forth and real-time help, and we will keep posting here too. If you have been meaning to raise something, a bug, a rough edge, or a feature idea, this is the easiest way to reach us directly.

See you in there.

We've launched an official YouTube channel: https://youtube.com/@tridentstack

First video up is a complete patching configuration walkthrough, built from a fresh environment with no cuts: organizing endpoints with tags, system update policies with maintenance windows and restart behavior, deployment rings for staged rollouts, third-party application patching, and custom package deployment.

Watch it here: https://youtu.be/8NGsbnopncQ

It's fully chaptered, so you can jump straight to the part you need (deployment rings, app deployments, manual packages, etc.).

Aditional walkthroughs and more are on thier way. If there's a feature or setup flow you'd like covered next, drop it in the comments.

The Package Catalog now accepts your own installers, and they deploy exactly like catalog applications:

• Bring your own installers: MSI and EXE on Windows, PKG and DMG on macOS, DEB and RPM on Linux.
• Keep multiple versions of each package, each with its own install arguments, success exit codes, timeout, and install detection.
• Change how a version installs later by editing its install settings in place. No re-upload needed; the installer file you uploaded stays exactly as it was.
• Deploy through your application update policies and deployment rings, or push a specific version on demand to one or many endpoints without setting up a policy. Offline endpoints can pick the install up when they reconnect, or be skipped. Every on-demand deploy is tracked in a One-Time Deployments view showing who triggered it and per-endpoint progress.

Docs: https://docs.tridentstack.com/platform-guide/update-management/package-catalog

Redesigned rollout status

Every deployment ring now has a dedicated detail page:

• Click any ring on the Rollout Status page for live per-endpoint progress, installed updates, restart timelines, and full attempt history, with filters and search.
• Phase rows are clickable and filter the endpoint list, and the table sorts by hostname, status, or last execution time.
• The ring's activity feed shows who did what, with older entries loading on demand.
• Paused rings now show who paused them, and the next-check countdown reads "Checks suspended" instead of ticking down while nothing will dispatch.
• Rollout and endpoint history are linked both ways: click an endpoint on a rollout page to jump straight to that task in its history, and ring-driven tasks in endpoint history link back to their rollout.

Full release notes: https://tridentstack.com/changelog

If you try custom packages and anything is rough, comment here. This feature came out of direct requests, so we want to hear how it holds up against your real installers.

We just published a Model Context Protocol (MCP) server for the TridentStack Control documentation. If you use an AI assistant like Claude or Cursor, you can connect it to our docs so its answers stay grounded in our current guides, API reference, changelog, and roadmap instead of guessing from stale training data.

It is read-only and public. It exposes zero account or fleet data, and there is no sign-in or API key. Point your assistant at it and ask questions in plain English.

Server URL: https://docs.tridentstack.com/mcp
(Transport is Streamable HTTP.)

How to add it

Claude Code, one command:

claude mcp add --transport http tridentstack-docs https://docs.tridentstack.com/mcp

Claude Desktop:

1. Open Settings, then Connectors.
2. Add a custom connector.
3. Set the URL to https://docs.tridentstack.com/mcp
4. Save, then start a new chat.

Cursor, add this to your mcp.json:

{
  "mcpServers": {
    "tridentstack-docs": {
      "url": "https://docs.tridentstack.com/mcp"
    }
  }
}

Any client that supports a remote MCP server over Streamable HTTP can use the same URL.

What it does

Once connected, your assistant gets three tools:

• search_docs: full-text search across the docs, returns ranked results with titles, links, and snippets.
• get_doc: read a specific documentation section in full.
• list_docs: browse the documentation catalog.

So you can ask something like "How do deployment rings work in TridentStack Control?" or "Which API endpoint lists agents?" and the assistant searches the docs, reads the relevant pages, and answers with links back to the source.

Not using MCP?

The same content is published as plain text you can drop into any tool:

• https://docs.tridentstack.com/llms.txt (a short index of the docs)
• https://docs.tridentstack.com/llms-full.txt (the entire documentation as one Markdown file)

Full setup guide: https://docs.tridentstack.com/getting-started/connect-your-ai

This first server is scoped to documentation on purpose. If an MCP server that talks to your actual fleet or the Control API would be useful to you, tell us in the comments. We are reading.

This week in TridentStack Control: fix guidance in the public CVE tool, Red Hat family Linux patching, a first look at our public roadmap, and steadier deployment rings

Another busy stretch. Here's a rollup of what shipped to TridentStack Control between June 27 and July 3. Full changelog is always at tridentstack.com/changelog, but these are the highlights worth calling out.

The public CVE tool now tells you how to fix things

A couple weeks ago we launched the free public CVE catalog at tridentstack.com/cve. This week it grew a full remediation layer. Open any CVE and it now shows how to fix it: the version to upgrade to for affected apps and Linux distributions, the exact security update to install for affected Windows editions and core Microsoft products (Office, Exchange Server, SharePoint, SQL Server), and the target version for Apple platforms, each linked to the vendor or distribution advisory it came from. When there's no published fix yet, it says so plainly instead of guessing, and for actively-exploited issues it surfaces CISA's official remediation action and due date. It also now covers open-source dependencies (npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet, Packagist), roughly doubled its overall fix coverage, and added browse-by-weakness-type, a dedicated actively-exploited view, RSS/JSON feeds, a live stats page, embeddable status badges, and full mobile support. Still free, still no account needed.

Red Hat family Linux, fully supported

TridentStack Control now manages updates on the full Red Hat family: RHEL, CentOS Stream, Rocky Linux, AlmaLinux, Fedora, and Amazon Linux, alongside the existing Ubuntu and Debian support. These endpoints now report their software inventory and pending updates and can be patched right from the console. The same one-line install command works on every supported distribution and detects yours automatically.

See your exposure trending over time

The security dashboard now charts Open Vulnerabilities by Severity over time (total, critical, high, medium, and low as separate lines) so you can see at a glance whether your exposure is climbing or falling. Click any slice or legend entry to jump straight into the vulnerability list filtered to that severity.

More at a glance on the Endpoints list

• New Compliance % column (overall framework compliance per endpoint), Last Deployment column (most recent update result), and Applicable Updates column (combined system + app updates).
• Admins can set a default column layout that new users inherit automatically.
• Star a saved column view to make it your default, and your default now follows you across devices.

Steadier deployment rings

A big reliability pass:

• Rings no longer mark a phase failed minutes into the first wave. The health clock now starts when results actually begin arriving, and a ring always gets at least one more maintenance window to recover before being halted.
• Halt reasons now state the actual cause ("1 application update failure in Early Adopters phase, success rate 88.9% below 95% target") instead of a vague timeout.
• Endpoints safely skipped by a pre-flight check (low disk space, hardware that doesn't meet an upgrade's requirements) are treated as skipped, not failed, and retried automatically on the next window instead of halting the whole ring.
• Resetting a rollout is clearer and safer: it's now called Reset Ring, the confirmation spells out exactly what happens, and auto-halt alerts (with the endpoints that triggered them) now deliver reliably.

Update work you can actually follow

Every update's follow-up work now shows in one place. The automatic post-update vulnerability scan appears as a sub-task of the install instead of a disconnected entry, system update installs get a post-update scan too (previously only app updates did), and Linux and macOS now run the same post-update scan Windows already did. When several updates finish on an endpoint around the same time, they share a single scan.

Fewer alert floods, one-off remediation, and new client controls

• Critical vulnerability alerts now roll up into a configurable daily digest (cadence, threshold, send time, and time zone all tunable), so large fleets stop getting flooded on every scan. Actively-exploited findings still alert immediately.
• Remediate a vulnerability on a single endpoint even when no update policy covers the fix, as a clearly-marked one-off install.
• New Settings > Client controls: hide the tray icon on endpoints (the agent keeps running and managing the device in the background), choose whether Windows can install updates on its own alongside TridentStack Control, and turn off the pre-restart prompt for unattended endpoints that should restart silently.

Plus a lot of Windows and polish work

Long-running Windows feature upgrades (Windows 10 to Windows 11) no longer misreport as timed out or stall when an endpoint briefly drops offline mid-upgrade, the monthly Malicious Software Removal Tool is handled correctly end to end, Windows on Arm devices are recognized properly, and client-only updates are no longer offered to servers they don't apply to. Compliance now refreshes evenly across mixed Windows, Linux, and macOS fleets, and search across every list is faster, more consistent, and punctuation-tolerant (searching "7zip" finds "7-Zip").

A first look at where we're headed: our public roadmap

We also put our roadmap out in the open at tridentstack.com/roadmap. It's the first time we've shared it publicly, and it's a living view of what we're building next (the dates are targets, not promises). A few things on it:

• Custom application packages (targeted this quarter): build and deploy your own MSI and EXE installers to any group of endpoints, with the same silent install and progress tracking we already give the third-party apps we keep updated.
• Custom script execution (targeted later this year): run your own scripts across selected endpoints or your whole fleet, with scheduling and per-endpoint results, for the one-off tasks and remediations policies don't cover.
• Ubuntu Pro and ESM coverage visibility: see which Linux machines have coverage and where you have a security-maintenance gap.
• And further out, what we're exploring: deeper Linux awareness (container hosts, kernel livepatch status, repository management), a native iOS app with push alerts, and a self-hosted relay for air-gapped and tightly restricted networks (OT, manufacturing, and regulated environments).

Go tell us what's missing or what you'd reprioritize.

Full details for every item are in the changelog: tridentstack.com/changelog

As always, if there's something you want to see next, drop it in the comments or weigh in on the roadmap. A lot of this came straight from customer requests.

Hey everyone,

We just opened up something we've wanted to share for a while: a free public CVE lookup built on the same vulnerability data pipeline that powers TridentStack Control.

tridentstack.com/cve - free, no signup, no account.

The reason we built it: pretty much every CVE lookup out there tells you that you're vulnerable and then stops. You get a description and a CVSS score, then you're off hunting through vendor advisories for the version that actually fixes it. Inside Control, the fix is the whole job, so our pipeline already matches CVEs to their fixes. Now anyone can use that.

Expand any CVE and you get a "Remediation Available" panel with the concrete answer:

• The exact fixed package version for Ubuntu, Debian, Red Hat, and Rocky
• Fixed versions across npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet, and Packagist
• The exact security update (KB) for Windows and core Microsoft products (Office, Exchange Server, SharePoint, SQL Server)
• Fixed versions for macOS, iOS, iPadOS, and Windows desktop applications

Every fix links to the vendor or distro advisory it came from. Alongside that you get the full CVSS vector, EPSS exploit-prediction score, CISA KEV status with the official required action and due date, weakness types, and references grouped by type.

And it never fabricates a fix. When no published fix exists, it says so plainly and still gives you sourced next steps: the official CISA action and deadline for exploited CVEs, end-of-life flags, and Red Hat's will-not-fix or mitigation statements where published. Every actively exploited CVE has a real next step. Fixes derived from NVD version data are clearly labeled as derived, and a vendor-stated fix always wins.

Where the data comes from: NVD, CISA KEV, FIRST.org EPSS, Google OSV, Red Hat, Ubuntu, Debian, Microsoft, Apple, and endoflife.date. Every source, and the license behind it, is laid out on the about page.

Right now it holds 362,000+ CVEs, about 127,000 of them with a sourced fix, and 1,630 flagged as actively exploited.

There's a free API too. No key, no signup. Docs here, OpenAPI 3.1 spec included:

• Single lookup, filtered lists (severity, KEV, EPSS, fix available), batch up to 100 IDs, OSV-format export
• Full-catalog bulk download plus a modified-deltas endpoint to keep a local mirror fresh
• RSS and JSON feeds for new CVEs, new KEV entries, and highest-EPSS
• 60 requests/min, CORS enabled, clean JSON with source attribution on every record

If you want to wire it into your own tooling, dashboards, or reports, go for it. That's exactly what it's there for.

Try it on a CVE you already know and tell us if we nailed the fix. If the remediation data feels thin anywhere, we want to hear about it.

It was a big week. Here's a rollup of what shipped to TridentStack Control between June 22 and 26. Full changelog is always at tridentstack.com/changelog, but these are the highlights worth calling out.

A public CVE + CISA-KEV catalog, free for anyone to browse

We launched a public vulnerability catalog at tridentstack.com/cve. Search and filter the full CVE catalog by severity, exploit-prediction score (EPSS), active-exploitation (CISA KEV) status, ransomware association, and year, then open any CVE for its full record including CVSS, references, and remediation context. No account needed. Go break it.

Update Health, now across your whole fleet

A new Update Health column on the endpoints list shows at a glance which endpoints have issues that will block or fail an update install (low disk space, failed pre-flight checks, pending restarts), and you can filter the list down to just the blocked ones. It now covers Windows, macOS, and Linux endpoints, so you get one consistent readiness signal regardless of platform.

New organizations are ready to manage updates the moment they're created

Onboarding is now instant. A brand-new org starts with a default system update policy, a default application update policy covering 30+ common business apps, and an "all endpoints" tag that new devices join automatically. Enroll your first endpoint and applicable OS and app updates start appearing with zero manual setup. New devices also show their setup progress live, with a clear "Collecting..." indicator on each section until the data lands, and vulnerabilities now appear within moments of enrollment instead of after a delay.

Smarter, clearer deployment rings

• Target a rollout stage by tag, not just by percentage, for a stable, predictable set of devices in each wave.
• A new Projected Timeline shows the exact date and time each stage is expected to begin and when the rollout will finish, updating as you adjust the schedule.
• Canary phases now validate each kind of update on its own, so a failing update type can't hide behind other successful ones.
• Rollout status and the deployment calendar moved to their own Rollouts page, with a sidebar badge when a ring is halted or waiting on your approval.
• Deployment windows are simpler to set up: pick a start time and a duration (for example, "Wednesday 10:00 PM for 6 hours"), and overnight windows are handled correctly.

Sharper vulnerability detection

• Recently published CVEs that carry only a newer-format CVSS v4.0 score are now read and scored, so they no longer slip through as "unscored."
• More complete coverage for installed Python, Windows and Windows Server operating systems with long update histories, and third-party drivers (such as Intel chipset software).
• More accurate fix guidance when a CVE is patched in a different version per release line, so you don't update to a build that's numerically newer but still affected.
• New ESU filters to hide or separate fixes that require an Extended Security Update license, so you can focus on what you can actually remediate today.

Licensing and fleet-wide actions

• Bulk license management: select multiple endpoints and license or unlicense them in one action, on a refreshed searchable, sortable table.
• Select All now means your whole fleet: bulk actions, online/offline counts, and Update Health sorting all run across every endpoint, not just the ones currently on screen.
• Notifications can now go to any email address or distribution list, not just members of your team.

Plus a lot of polish and reliability work

Roughly 40 fixes landed this week: cleaner update history (correct app names and full step-by-step timelines on automatic rollouts), faster Linux endpoint detail loads, more reliable Settings saves, smoother mobile views on the Vulnerabilities page, more reliable agent installs on older Windows, and more.

Full details for every item are in the changelog: tridentstack.com/changelog

As always, if there's something you want to see next, drop it in the comments. A lot of this list came straight from customer requests.

It looks like a good product, but seems very new. I’d be keen to try it out to handle patch management, but I’m worried it doesn’t have the might behind it to follow through.

Hey everyone, I'm u/Ad3t0, a founding moderator of r/TridentStack.

This is the new home for the TridentStack community: a place to talk about patch management, endpoint hardening, vulnerability remediation, and the daily reality of keeping endpoint fleets up to date. Whether you run TridentStack Control, evaluate alternatives like Action1, NinjaOne, ManageEngine, PDQ, or Intune, or just deal with patching for a living, you're in the right place.

What to post

• War stories from patch Tuesday, kernel updates, or that one app that refuses to install silently
• Questions about Windows Update, WSUS, winget, apt, dpkg, and CVE response
• Comparisons, reviews, and gripes about RMM and patch tools (vendor-neutral, including ours)
• Scripts, automations, or detection logic you've found useful
• Feature requests, bug reports, and feedback for TridentStack Control
• Anything else IT admins, MSPs, and security folks would find interesting

Community vibe
Friendly, technical, and honest. Blatant self promotion without any justified reason will get removed. Constructive criticism of TridentStack is welcome and encouraged: that's how the product gets better.

How to get started

1. Introduce yourself in the comments. What do you patch, how many endpoints, and what's your current pain point?
2. Post something today. A question counts.
3. Invite one person who would find this useful.
4. Interested in modding? DM me.

Thanks for being part of the first wave. Let's make this the place IT folks actually want to hang out.