Outdated software is the easiest way in
Most attacks don’t need a new exploit, just a machine that missed last month’s fix. How to keep a mixed Mac and Windows fleet patched.
When people picture a security breach, they imagine something clever: a brand-new exploit nobody has seen before, a nation-state team, a movie-style hack. The reality is usually more boring. A lot of attacks walk through a door that was fixed months ago, on a machine that never got the fix.
Outdated software is one of the easiest ways into a company, and it's one of the most fixable. It doesn't matter whether your fleet runs on Macs, Windows PCs, or, like most companies, both. The problem looks the same on each, and so does the answer: know what's installed, keep it current, and don't leave it up to whoever happens to be sitting at the keyboard.
Why patching slips
Nobody decides to run vulnerable software. It happens a little at a time.
- Updates wait on people. On a Mac, it's "Remind Me Tomorrow." On Windows, it's "Pause updates" or a restart that keeps getting pushed back. Both are reasonable in the moment. Over a few weeks, they add up to a machine that's well behind.
- The operating system is only part of it. Browsers, PDF readers, video-call apps and chat clients all update on their own schedules, if they update at all. A fully patched OS running a year-old copy of a popular app is still exposed.
- Developer machines are their own world. Homebrew, npm, Python packages, Ruby gems and language runtimes pile up quietly on both Macs and PCs. Some of them are past end-of-life and will never get another security fix.
- You can't patch what you can't see. If you don't have an accurate inventory of every device and everything installed on it, you're guessing.
Keeping Macs current
Apple has made big improvements to how organizations manage updates, and Xavier is built to use them.
macOS updates. With Apple's Declarative Device Management, you can require a specific macOS version by a deadline, or have devices follow the latest release after a deferral window you choose. That turns "please update when you get a chance" into a date the Mac itself enforces. Xavier can also tell Macs to scan for, schedule and install updates, and its "OS Updates Current" compliance rule shows you at a glance which machines still have updates waiting.
OS update status
Update available- Running
- macOS 15.4
- Newest
- macOS 15.5
Enforce OS Update (DDM)
Currently enforcing macOS 15.5 by Fri 5:00 PM.
Third-party Mac apps. This is where most fleets fall behind, so I put a lot of work here. Xavier integrates with Munki, a well-proven tool for Mac software management, and adds what I call Munki Sources. Xavier watches where an app publishes its releases, downloads each new version, checks it against a pinned checksum and imports it into a testing catalog. You can try it on a few machines, then promote it to everyone. For apps you trust, you can let Xavier promote updates automatically, or just get notified when a new version appears.
Munki Sources
- 1New releasespotted at the source
- 2Downloadedstraight from the publisher
- 3Checksummatches the pin
- 4Drafttesting catalog
- 5Productionpromoted to everyone
Developer tools. Xavier inventories Homebrew, npm, pip and Ruby gem packages on every Mac in real time. You can see what's outdated across the whole fleet, and install, update or remove packages remotely.
Keeping Windows current
Windows has its own update model, and Xavier manages it natively over the same OMA-DM protocol Windows uses for enrollment.
Windows updates. Xavier's visual profile builder pushes Windows Update rings, with deferral periods, branch readiness, active hours and scheduled installation. Rings let you send updates to a small test group first, then to everyone else once you're confident nothing broke. Xavier's inventory reports installed, failed, pending and available updates on each PC, and you can review and approve updates from the console. A failed update stands out right away, instead of sitting unnoticed for weeks.
Update rings
Third-party Windows apps. Windows now has good package managers, and Xavier uses them. You can assign winget packages to every PC or to specific groups. You can define Chocolatey package sets that Xavier re-applies on a schedule, so machines that drift get pulled back in line. For software that doesn't come from a package manager, you can upload MSI, EXE, MSIX and APPX installers to Xavier's app library and deploy them to devices or groups.
Developer tools. Developers on Windows have the same sprawl as developers on Macs. Xavier checks npm, pip and Ruby gem packages on Windows for outdated versions, too.
The things both platforms share
Some risks don't care which operating system you run, so Xavier handles them the same way everywhere.
- End-of-life runtimes. Node, Python, Ruby, Go and .NET are checked against their end-of-life dates. A runtime past its support date won't get security fixes, and Xavier's "No End-of-Life Versions" rule flags it.
- Vulnerable dependencies. Xavier can scan project dependencies for packages with known vulnerabilities. It reads the manifest files as text, so no build tool runs and nothing gets installed during a scan.
- One compliance view. Outdated software, missing updates and security settings like FileVault, BitLocker, Gatekeeper and Defender all show up in one place, and many issues can be fixed right from the console.
Patching isn't a project you finish. It's a habit, and the job of a management tool is to make that habit automatic.
A simple patching playbook
Whatever tools you use, the same few habits keep a mixed Mac and Windows fleet in good shape:
- Start with inventory. Know every device and everything installed on it, including developer tools.
- Test, then roll out. Use a testing catalog on Macs and update rings on Windows, so a bad update reaches five machines, not five hundred.
- Set deadlines, not reminders. A short deferral is fine. An unlimited one is how machines fall months behind.
- Automate third-party apps. The OS is the easy part. Munki on the Mac and winget or Chocolatey on Windows close the bigger gap.
- Retire what's past end-of-life. No amount of patching helps software that will never get another fix.
- Watch the numbers. Track how many devices are current each week. If that number drops, you'll know before an attacker does.
Why I built it this way
Most companies don't run one platform. They have Macs in design and engineering, Windows PCs in finance and at the front desk, and phones everywhere. Patching each platform in a separate tool means separate reports, separate blind spots and twice the work. I built Xavier so one console can answer a simple question for the whole fleet: is everything up to date, and if not, what isn't?
Xavier is $8 per device per month, the same on every platform, with a 30-day free trial that includes every feature. If you'd like to see how it handles patching across your Macs and PCs, try the live demo or start a trial.