SinonKeystone is a self-hosted, WSUS-class update platform for Windows, Linux and macOS. It mirrors vendor catalogues into a content store you control, gates every patch through approval and deployment rings, and turns "we keep things patched" into a record you can hand an assessor.
One agent, three operating systems. Verified payloads. Air-gap capable.
Operating Systems
Windows, Linux and macOS from one server and one agent — not three tools with three consoles and three sets of numbers.
Vendor Upstreams
Microsoft Update, APT, YUM/DNF and Apple Software Update, each mirrored into a local content store with its own trust chain checked.
Compliance Frameworks
CIS Controls v8, NIST SP 800-53 r5, EU NIS2, SOC 2 and the NCSC CAF — 70 controls, 63 bound to automated checks.
Automated Checks
Measurable assertions about SLA breach, coverage, change control, supply-chain integrity and audit integrity.
Deployment Modes
Bare metal (systemd), Docker Compose, Kubernetes via Helm, and fully air-gapped from a signed bundle.
Distributing patches is the easy half. The hard half is proving that the right people authorised the right change, that it was tested before it reached production, and that it stopped when it started breaking things. That is what this platform is built around.
Approvals are recorded per update and per ring, because clearing a patch into a pilot ring is not authorisation for production. Quorum is counted from individual signatures, self-approval is refused by default, and the person who authorises a change is separable from the person who deploys it.
Updates advance through ordered rings, and promotion is gated on three things: soak time, a minimum reporting fraction, and a failure rate below threshold. A ring where most hosts stayed silent has a 0% observed failure rate and has demonstrated nothing — so silence does not count as success.
The failure rate is evaluated on every result that comes back, not on a timer. A rollout that starts breaking hosts stops itself before it reaches the next one, rather than completing and leaving you to work out what happened.
Windows are authored in tenant-local time and honour change blackouts, so a freeze is a freeze. Installs will not start so close to a window's end that they run past it, and a restart happens only where the window permits one.
Deciding not to patch something is a legitimate answer — once. Every exception names a risk owner, a justification, compensating controls and a mandatory expiry, and expires on its own. An exception with no end date is a permanent hole with paperwork attached.
Out-of-cycle fixes get an emergency path that bypasses quorum, is time-boxed, and expires automatically. It is reported separately in every compliance evaluation, because an emergency route indistinguishable from the routine one is not a control.
An update server installs software as root on every machine in the estate. A compromised mirror is not a data breach — it is simultaneous arbitrary code execution across the whole fleet. Everything in the content path is built to fail closed.
Only the top of an APT or RPM trust chain is signed. The InRelease file and the repomd signature are verified before any digest inside them is believed — because a tool that trusts a package index it never authenticated has verified nothing at all.
Payloads are checked against the publisher's digest before entering the store, and again on the endpoint before an installer touches them. Between those points the bytes cross a network and a cache the agent does not control.
A payload whose digest does not match is quarantined and raised as a security event. It is never retried, because retrying a tampering attempt simply fetches it again. Weak digests are refused outright for anything that gates code execution.
Every approval, deployment, revocation and integrity rejection lands in a hash-linked audit chain, written in the same transaction as the change it describes. Altering or removing a record breaks verification of every record after it.
One site pulls from the vendors; the rest pull from it. A branch office on a thin link fetches a 700 MB cumulative update once instead of once per host, and a downstream site can be pinned to inherit its parent's approvals.
In air-gapped mode all outbound fetching is refused and content arrives as a signed bundle whose signature is verified before anything is unpacked. An isolated estate still gets patched on a defined cadence.
Most compliance dashboards score well by counting controls they never checked. This one does the opposite: a control with no automated check behind it is reported as not assessed and excluded from the score, and every framework score is displayed alongside the fraction of controls it actually covers.
| CIS Controls v8 | Safeguards 1.1, 2.1, 4.1, 7.1–7.7 (continuous vulnerability management) and 8.2/8.5 (audit logging) |
|---|---|
| NIST SP 800-53 r5 | SI-2 flaw remediation and its enhancements, SI-7, the CM change-control family, RA-5, RA-7, AU-2/AU-9/AU-12, AC-5, AC-6 |
| EU NIS2 | Article 21(2) risk-management measures — particularly (d) supply chain and (e) vulnerability handling — and Article 23 reporting evidence |
| SOC 2 | CC6.1, CC6.8, CC7.1, CC7.2, CC7.4, CC8.1 change management, CC9.1, and Availability A1.2 |
| NCSC CAF v3.2 | Objectives A–D, with B.4.d vulnerability management as the central outcome |
Hosts that are not enrolled are invisible to every measurement here and are never counted as compliant — a machine nobody installed the agent on does not quietly improve your score. Where a control is inherited from elsewhere, such as MFA from SinonAuth or macOS package signature verification from Apple, the documentation says so rather than claiming it.
| Platforms | Windows (Windows Update Agent), Linux (apt, dnf, yum, zypper), macOS (softwareupdate) |
|---|---|
| Upstreams | Microsoft Update client web service, Debian/Ubuntu APT, RHEL/Fedora/SUSE YUM/DNF with errata, Apple Software Update catalogue |
| Content integrity | SHA-256 minimum; OpenPGP verification of APT InRelease and RPM repomd; digest-derived storage paths; quarantine on mismatch; second verification on the endpoint |
| Change control | Per-update, per-ring approvals; configurable quorum; separation of duties; time-boxed emergency override; ordered deployment rings with soak, reporting-coverage and failure-rate gates |
| Scheduling | Maintenance windows in tenant-local time with cron expressions, change blackouts, no-start cut-offs, and reboot permission per window |
| Frameworks | 5: CIS Controls v8.1, NIST SP 800-53 r5, EU NIS2 (2022/2555), SOC 2 (2017 TSC), NCSC CAF v3.2 — 70 controls, 63 bound to 14 automated checks |
| Audit & evidence | Per-tenant hash-linked audit chain with on-demand verification; dated compliance snapshots; exportable evidence bundles stating scope and coverage |
| Agent | Single Go binary, 6 build targets (Windows, Linux, macOS × amd64/arm64); reports facts only — applicability is decided server-side |
| Agent packaging | MSI (WiX), DEB, RPM, PKG and tar.gz, with a hardened systemd unit |
| Topology | Upstream/downstream replication sites, deferred content, per-site bandwidth limits, replica-mode approval inheritance |
| Databases | PostgreSQL 16, Redis 7 |
| API | 9 route modules, 47 paths, 55 endpoints |
| Multi-tenancy | Tenant-scoped throughout; agent tenancy resolved from the stored credential, never from the request |
| Backend stack | Python 3.11+, FastAPI, SQLAlchemy 2 async, asyncpg, OpenTelemetry; separate scheduler and sweeper workers |
| Frontend stack | React 18 with TypeScript, Vite, Redux Toolkit, Tailwind CSS |
| Deployment | Bare metal (systemd), Docker Compose, Kubernetes (Helm), fully air-gapped; every installer supports upgrade and uninstall |
A self-hosted, centralised update management platform. It mirrors vendor update catalogues from Microsoft, APT, YUM/DNF and Apple into a local content store, gates every update through an approval and deployment-ring process, applies them within maintenance windows via a single agent on Windows, Linux and macOS, and evidences the result against five compliance frameworks. It runs on PostgreSQL and Redis on your own infrastructure.
WSUS covers Microsoft products on Windows. SinonKeystone covers Windows, Linux and macOS from one server with one agent, and adds the change control WSUS never had: approval quorum with separation of duties, deployment rings gated on soak time and observed failure rate, an automatic halt when a rollout starts breaking hosts, governed exceptions with mandatory expiry, and a hash-linked audit chain that produces evidence for CIS, NIST, NIS2, SOC 2 and the CAF.
Because "automatic updates are on" is not an answer to NIS2 Article 21(2)(e) or SOC 2 CC8.1. Those ask which fix, authorised by whom, deployed when, to which hosts — and whether the record can be shown to be unaltered. Automatic updates also give you no staged rollout, so a bad vendor patch reaches production at the same moment it reaches everything else.
Layered verification, all of it failing closed. Repository metadata is authenticated before any digest inside it is trusted. Payloads are verified against the publisher's digest before entering the store and again on the endpoint before an installer touches them. Anything that fails is quarantined and reported as a security event rather than retried, and digests weaker than SHA-256 are refused outright for content that gates code execution.
Yes, and properly. In air-gapped mode all outbound fetching is refused rather than merely discouraged. Content arrives as a signed bundle, and the signature is verified before anything is unpacked, with the manifest verified before anything is installed. Both are hard failures. The installer will also warn you if the public key you supplied is identical to one shipped alongside the bundle, because a key that travelled with the payload authenticates nothing.
It becomes state unknown, not compliant. Yesterday's clean inventory is not evidence about today's machine, so an endpoint that goes silent past its freshness window drops out of the compliant count and is surfaced as a coverage gap. Silence is the most common way an unpatched host hides, and a dashboard that treats it as green is worse than no dashboard.
No, and it does not claim to. Missing-patch state is derived from reported inventory against vendor catalogues, which is not the same as an authenticated vulnerability scan. SinonPosture covers posture and configuration scanning; SinonKeystone covers getting the fix approved, deployed and evidenced. The two are complementary, and the documentation is explicit about which controls each one actually meets.
Closed beta. The backend, console and cross-platform agent are built and tested, with the agent cross-compiling to all six Windows, Linux and macOS targets. Request access and we will walk you through coverage for your estate, the deployment options, and what the compliance mapping does and does not claim.
SinonKeystone is in closed beta. Request access for a coverage assessment against your estate, deployment documentation, and a walkthrough of the compliance mapping.
Talk to an engineer about update management on infrastructure you own — or let us host it for you and still own every byte.