Automate Patching for Apps and OSes

Detect and remediate vulnerable applications

Iru monitors Mac and Windows endpoints continuously and patches based on vulnerability severity. The right apps update on the right devices.

Keep devices on the OS version you specify

Set a version target and enforcement deadline for your Mac computers. Iru handles the download, caching, and user notifications.

Zero disruption to end users

Iru updates apps silently when they're closed and prompts users ahead of enforcement deadlines. Work continues uninterrupted.

Unified by design. Built for the AI era.

Iru AI is designed from the ground up to connect a grid of agents behind the scenes—across identity, endpoint, and compliance. Powered by the Iru Context Model, it understands your users, apps, and devices to act safely, intelligently, and in context across your organization.

Explore Iru AI

Vulnerabilities ranked by severity, software, and device scope
Patching triggers automatically when a CVE is detected, with no ticket or manual review
Auto Apps keeps 230+ Mac and Windows apps current without interrupting work

Create test groups and stagger deployment so your pilot group gets the update before the broader fleet
Uses Apple's declarative device management on Mac and the Microsoft MDM protocol on Windows.
See version distribution across your fleet in real time

Updates arrive with advance notice so users can plan their restart before the deadline
One agent handles everything, on Mac and on Windows
Employees can install the apps they need through Self Service without waiting on IT

A fully automated migration experience

We’ve created an automated migration tool that seamlessly migrates large organizations off of legacy MDM providers, making it easier than ever before to transition to a modern platform.

Book a demo Request a quote

Compliance

Learn more about Trust Center

Accelerate deals with a public portal for your security and compliance posture.

Endpoint

Learn more about Endpoint Management

Secure and control devices with unified endpoint management.

Endpoint

Learn more about Endpoint Detection and Response

Detect, investigate, and automatically contain threats in real-time.

Endpoint

Learn more about Vulnerability Management

Unify vulnerability detection, prioritization, and autonomous remediation.

Identity

Learn more about Workforce Identity

Eliminate passwords entirely and provide effortless single sign-on to apps.

Learn more about Iru AI

Turn context into insights and actions with agentic AI across the entire Iru suite.

Let your team focus  on what matters

Iru replaces fragmented tools with one AI-powered platform, so IT & security spend less time chasing tickets and more time improving the business.

Book a demo Request a quote

Frequently asked
questions

Get answers to commonly asked questions

Which apps and devices does automated patching cover?

Auto Apps patches 230+ Mac applications and 220+ Windows applications. The most common business and productivity apps are included. See the full catalog here.

How quickly does Iru patch after a vulnerability is discovered?

Iru Agent detects new and updated software in real time and matches each app against its vulnerability database. Patches deploy on the schedule IT sets, from immediate to a defined deadline.

Will patching interrupt my users?

No. Apps update silently when they're closed. Users get a prompt before enforcement deadlines, not a mid-workflow pop-up. Security moves forward without disrupting work.

Can I see which devices are at risk before I act?

Yes. The vulnerabilities view shows what's exposed, sortable by severity, software, and device scope. Impact analysis maps the blast radius so your first action is the right one.

Do I need a separate agent or tool for vulnerability management?

No. Everything runs through Iru's lightweight endpoint agent. One agent handles detection, prioritization, and patching across your fleet (Mac and Windows only). Nothing extra to install.

Can I enforce a specific OS version across my fleet?

Yes. Managed OS lets you set a version target and a deadline, and Iru enforces it automatically. Devices that fall behind are pushed forward; devices at or above the target stay where they are until you update the policy.

How do I manage OS updates without Active Directory or Intune?

Iru brings Windows Update enforcement to cloud-only environments — no AD domain join, no WSUS infrastructure, no Endpoint Manager licensing required. Set your version target and deadline in the same Blueprint workflow you use for everything else.

What happens if a device misses the update deadline?

If a device is offline when the deadline passes, it returns to Iru in an "Update Past Due" state. Iru enforces the update as soon as the device checks back in.

What's the difference between deferring updates and enforcing them?

Deferral delays when an update becomes visible to users. Enforcement sets a hard deadline by which it must be installed. Configure the enforcement deadline and Iru intelligently prompts end users and allows them to defer until the enforcement deadline.

Can I hold a specific version of an app when a vendor or workflow requires it?

Yes. You can pin a specific version, exclude an app from automatic patching, or accept the risk on a flagged CVE indefinitely — useful when a workflow depends on legacy behavior or a vendor hasn't certified the latest release.

Can I apply different patch cadences to different teams — e.g., aggressive for general staff, lighter for engineers?

Yes. Patch policies scope to Blueprints, so you can set aggressive enforcement for general staff and looser windows for engineering teams that need to test or hold versions. Exclusions apply per group, per app.

What happens when a zero-day drops — can I override my normal patch windows on demand?

Yes. You can push a patch immediately outside the normal cadence, target it to the affected Blueprint or device group, and notify users — without rewriting your standing policy.

Does Iru handle the app restart or device reboot when a patch requires it?

Yes. Iru manages the user prompt, countdown, and forced restart when an app or OS update requires it — including browsers like Chrome that need a relaunch to apply the patched binary.

Where does Iru's vulnerability data come from — NVD, vendor advisories, or both?

Both. Iru ingests CVE data from the National Vulnerability Database and supplements it with vendor security advisories so detection isn't waiting on NVD publication lag.

Does patching still work for devices that are remote, off-VPN, or rarely on the corporate network?

Yes. The Iru Agent runs over the public internet — no VPN, no GPO, no domain join required. Remote laptops get the same patch enforcement as on-network devices the next time they check in.

Automate software installs and patching