# Patch management for closed and DMZ networks

Keep systems patched even when your Patch Manager Plus server cannot connect directly to the internet. Patch Manager Plus supports closed, DMZ, and air-gapped environments by enabling patch and vulnerability data to be downloaded on an internet-connected machine and securely transferred to the isolated environment for scanning, testing, approval, and deployment.

## Key features

### Patch systems without direct internet access

Keep endpoints up to date even when the Patch Manager Plus server is located in a network where internet access is restricted or completely unavailable.

### Sync patch data offline

Use the Patch Manager Plus patch sync tool to download the required patch and vulnerability data on an internet-connected machine. Transfer the data to the closed network and import it onto the Patch Manager Plus server.

### Patch DMZ systems

Keep servers and other endpoints in a DMZ patched without requiring the Patch Manager Plus server to establish direct outbound internet connectivity from the protected network.

### Support air-gapped environments

Manage patches in environments with no physical or logical connection to external networks. Transfer the required patch data into the isolated environment and deploy it to endpoints from within the network.

### Continue patching behind the firewall

Once the required patch data is available inside the closed network, administrators can scan endpoints, review applicable patches, test deployments, approve patches, and deploy them without requiring the Patch Manager Plus server to access the internet.

### Control patch transfers

Keep the movement of patch data into restricted environments as a defined, repeatable process instead of relying on ad hoc manual patch collection and installation.

### Manage Windows, macOS, and Linux endpoints

Patch supported Windows, macOS, and Linux endpoints in closed environments along with more than 1,100 third-party applications.

### Maintain deployment visibility

Track patching activity within the closed environment and identify deployment statuses across endpoints. This gives administrators visibility into the patching process even when the environment itself is isolated from the internet.

### How offline patch management works

Patch Manager Plus separates patch data acquisition from patch deployment, enabling administrators to maintain a patching workflow even when the product server cannot access the internet.

1. Download patch data. Use an internet-connected machine to obtain the required patch and vulnerability data.
2. Transfer the data. Move the downloaded data into the closed, DMZ, or air-gapped environment using the organization's approved transfer mechanism.
3. Import the data into Patch Manager Plus. Import the data onto the Patch Manager Plus server inside the restricted network.
4. Scan and evaluate endpoints. Scan the endpoints in the isolated environment to identify applicable patches.
5. Test and approve patches. Test patches on selected systems before wider deployment and approve patches according to your organization's patching process.
6. Deploy and monitor patches. Deploy approved patches to the required endpoints and monitor deployment statuses from within the closed network.

### Why patching closed networks is harder

- No direct access to vendor updates: When the Patch Manager Plus server cannot connect to the internet, it cannot directly retrieve the latest patch information and updates from vendors.
- Strict network segmentation: DMZ and secured environments are intentionally separated from other networks. Opening outbound internet access simply to support patching may not be acceptable under the organization's security policy.
- Complete isolation: Air-gapped environments have no physical or logical connection to external networks, making conventional automated patch downloads impossible.
- Difficulty controlling manual processes: When patches are transferred manually, organizations need a consistent process for identifying required updates, moving them into the restricted environment, testing them, deploying them, and maintaining an audit trail.
- Increased exposure due to delayed patching: Security controls that isolate critical systems do not remove the need to keep those systems patched. A restricted environment can still contain systems running vulnerable software that require timely security updates.

## FAQ

### What is a closed network in Patch Manager Plus?

A closed network is any environment where the server has no direct internet access, including secured internal networks, DMZ environments, and fully air-gapped setups. It is defined by internet connectivity restrictions, not by the network topology.