Automatic Patch Management is available for:

• All systems covered under an active support contract that includes proactive support services, and

• All systems hosted within Spearhead Cloud with an SLA level of Standard or higher.

If a system is legacy/EOL or has special constraints, we may recommend exceptions or a custom approach.

We apply operating system vendor patches and third-party patches delivered through approved repositories, including (where applicable) repositories such as:

• distribution/vendor repos (e.g., Debian/Ubuntu/RHEL family),

• third-party vendor repos (e.g., Percona, PHP repos, etc.).

Scope is OS-level security and critical updates; we do not perform major upgrades as part of this program.

 In most cases, patching is non-disruptive or causes only brief service interruptions:

• Some services may restart and become temporarily unavailable for 1–2 minutes.

• If patches require a system reboot, downtime can be up to ~15 minutes per system (typically less), depending on boot time and service startup.

We design our automation to minimize risk and to detect issues quickly:

• Prerequisite: before enabling Patch Management, we validate that a functional backup process is in place.

• No backup = no automatic patching: if backups are not available/functional, the automated process will not be applied.

• Patches are applied during normal operating hours, so any unlikely issues can be detected and handled immediately by our team.

This refers to patching outside the regular monthly window for situations such as:

• critical vulnerabilities with active exploitation in the wild,

• high-severity vendor advisories that require immediate action.

If such a case occurs, we will handle it as a security change, aligned with your SLA and operational constraints (and, where applicable, an agreed communication path)

Yes.

• Exclusions: specific systems can be excluded on request; however, excluding systems means they may remain unpatched and therefore at higher security risk. We will ask you to explicitly acknowledge this risk.

• Custom windows: the maintenance window can be adjusted to another preferred time covered by your SLA.

If the requested timeframe is not covered by your current SLA, an SLA upgrade (or a separate agreement) is required to support that window.

By default, Patch Management is fully automated, and notifications are handled internally:

• Our monitoring platform is informed so maintenance suppression is applied during patching.

• Our team receives alerts from both the automation process and monitored systems if anything fails or behaves unexpectedly.

Customer notifications are optional and can be enabled on request (e.g., pre/post email summary or ticket updates).

Before enabling Patch Management, we validate that a functional backup process is in place for the systems in scope.

Depending on platform and agreed setup, this may include backups and/or snapshots.