senn-techPatch Management Without SCCM: Updates in SME Daily Operations
Unpatched systems are the most common entry point for attackers — not zero-days, but known vulnerabilities from six months ago. NIS2 requires patch management as a mandatory measure. Here’s how we do it without significant licensing costs.
Linux VMs: unattended-upgrades
Ubuntu and Debian come with unattended-upgrades. Once enabled, it automatically pulls and installs security patches overnight.
apt install unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades
Important: This only applies to security updates from the official repositories — no major version jumps, no kernel panics on production systems. The configuration allows precise control over which package sources are automatically updated.
Proxmox Hosts
Proxmox includes its own update mechanism. Without a subscription (for non-production systems) or with a subscription (for serious operation). It’s not self-running — we set a monthly maintenance window on the first Sunday, 6:00–8:00 AM.
apt update && apt dist-upgrade
# Check if reboot is needed
[ -f /var/run/reboot-required ] && reboot
In an HA cluster, we update one host at a time. VMs migrate via live migration to the remaining nodes. The service continues running while patching occurs.
Docker Containers: The Underestimated Maintenance Task
Container images become outdated. Not the code — it still works — but the underlying base image accumulates CVEs. Docker updates replace the image entirely:
docker compose pull
docker compose up -d
No one automates this blindly. A Watchtower can do it, but we prefer manual triggering with a prior VM snapshot on which the containers run. To see which image is actually vulnerable, we run a vulnerability scan with Trivy — trivy image <name> lists known CVEs before deciding how urgent the pull is.
Windows: Yes, It Still Exists
Winline, NoSpamProxy, Translogica clients — they run on Windows. Patch management there means: WSUS or simply monthly maintenance windows, defining Active Hours, enabling automatic updates, but delaying them by a week (to wait for potential Microsoft rollbacks).
NIS2: Documentation Is Half the Battle
Having patched is good. Being able to prove that and when patching occurred is NIS2-compliant. A log file, a markdown log entry, a screenshot — the main thing is being able to show in an audit that updates are applied regularly.
Conclusion
Patch management doesn’t require SCCM or an enterprise budget. It needs a maintenance window, safe automations, and a checklist checked off every month. The biggest enemy of patch management isn’t the technology — it’s procrastination.
Can we auto-patch Linux VMs without endangering production systems?+
Yes. Ubuntu and Debian ship unattended-upgrades, which pulls security patches from the official repositories automatically overnight. This covers only security updates — no major version jumps — and can be precisely scoped to specific package sources. That keeps the VMs current without a kernel leap risking the stability of a production system.
How do we patch Proxmox hosts in an HA cluster without downtime?+
We set a monthly maintenance window and update one host at a time. The VMs migrate via live migration to the remaining nodes, so the service keeps running while patching occurs. Afterward we check whether a reboot is needed and roll that out in a controlled way. The cluster stays available while the hosts are still patched on a regular schedule.
Is that enough to satisfy the NIS2 documentation duty?+
NIS2 demands not just patching but proof of that and when patching occurred. Having patched is good; being able to demonstrate that updates run regularly is the real obligation. A log file, a markdown log entry, or a screenshot is enough, as long as you can show in an audit that updates are applied continuously. Structured maintenance windows deliver exactly that evidence.