When Are Operating System Patches Available?

Issue

A device does not show a newly released operating system patch immediately after the vendor (Microsoft, Apple, or a Linux distribution maintainer) announces it, even though the patch is publicly available. Administrators often expect the patch to appear in Automox the moment it is released, and see a gap between vendor release and the patch showing up as available on a device or in a patch policy.

Environment

• Automox Console, all organizations
• Windows, macOS, and Linux devices running the Automox agent
• Applies to operating system patches; third-party application patching follows the same scan/detection model but is sourced from software-catalog vendor resolvers rather than the OS vendor

Overview

Automox does not maintain its own repository of operating system patches. For each OS, the agent asks the vendor's own update mechanism what is available and reports that back to the console:

• Windows — the agent checks against Windows Update (or WSUS, if the group is configured to point there instead; see OS Patch Management Settings for Groups).
• macOS — the agent checks against Apple's softwareupdate catalog. If an update does not appear in Apple's own Software Update on that device, Automox cannot see it either; see macOS Devices Not Receiving Expected Patches: Troubleshooting.
• Linux — the agent checks against the distribution's native package manager (apt, yum, or zypper) and whatever repositories the device is configured to use; see Linux: Recommendations, Requirements, and FAQs.

If the OS vendor has not made a patch available to a given device — because of a phased/staged rollout, a blocked update source, a missing prerequisite update, or a network restriction — Automox will not show it either, regardless of how the console is configured. Why an update or patch does not appear in Automox covers that troubleshooting path in detail.

Two other factors, unrelated to whether the vendor has released the patch, determine when a device reports it as available:

1. Scan cadence. A device only refreshes its patch list when it scans. The scan interval is configurable per group between 4 and 24 hours (24 hours by default); a device with a 24-hour interval can take up to a day after vendor release to report a new patch as available, even though the patch itself already exists. See Scan Interval Best Practices for recommended intervals by group type, and run a manual scan to force an immediate check rather than waiting for the next interval.
2. Patch policy filters. Even after a device reports a patch as available, a policy's filters decide whether that patch is acted on in the next run. A Patch Age filter defers deployment until a patch has been publicly available for a set number of days (1–180), calculated from the date the vendor published it — so a policy with a 9-day age threshold will not touch a patch released yesterday, by design. A By Severity policy only acts on patches whose CVE-derived severity matches the selected levels (Critical, High, Medium, Low, None, Unknown); see Creating a Patch Policy for how these and other Advanced Policy filters (Patch Source, Patch OS, Display Name) combine.

Windows and Patch Tuesday

Microsoft releases its monthly Windows quality updates — the cumulative security and non-security fixes commonly called "Patch Tuesday" — on the second Tuesday of most months, with occasional out-of-band releases outside that cycle for urgent fixes. See Microsoft's own description of the update phases and cadence in Windows client updates, channels, and tools. Because Automox reads directly from Windows Update, a Windows patch policy can only see and act on a given month's updates after both:

• Microsoft has published the update, and
• the device has scanned since that publish time.

A Patch Tuesday schedule in a policy automatically anchors patch windows to the second Tuesday of the month with a configurable delay, so the schedule doesn't need manual adjustment when the date shifts month to month. Combine that with a scan interval short enough to catch the release the same day, or trigger a manual scan, if the goal is same-day visibility.

Notes

• Automox does not cache or independently verify OS patches; it is a pass-through on top of each OS vendor's own update mechanism, so vendor-side delays (staged rollouts, regional mirrors, blocked update sources) show up as delays in Automox too.
• Windows devices pointed at WSUS instead of Windows Update follow WSUS's own approval and sync timing, which can lag public release further; confirm which source a group uses in OS Patch Management Settings for Groups.
• A device that appears "Installed" for a macOS update may only have it downloaded and staged, not fully applied, until after a reboot.