Patchmageddon
JVM patching & OpenJDK migration specialists

Find every JVM.
Patch it in weeks, not quarters.

We find every Java runtime in your estate, patch the non-critical apps in days with fast rollback as the safety net, and move you off Oracle Java wherever it isn't earning its cost.
Book a Quick ScanHow we work
Estate assessment: example findings
Week 2

  • JVMs discovered

    118 were missing from the CMDB

    340

  • Past end of life

    Java 6, 7 and unsupported 8 builds

    60

  • Critical CVEs open 400+ days

    On internet-facing hosts

    12

  • Oracle JDK installs

    Putting 5,000 employees in license scope

    38

Illustrative example. Your numbers will differ, which is why you should know them.

The problem

Every quarter, a new batch of Java CVEs. Every quarter, the same scramble.

Oracle and the OpenJDK community ship critical patch updates every January, April, July and October. Most enterprises can't get through the last batch before the next one lands.
  • You can't patch what you can't find
    Most enterprises have no current list of their JVMs. The ones bundled inside vendor products, app servers, CI tools and container images are the ones that get missed.
  • Regression testing is the bottleneck
    Full regression testing for every quarterly JVM patch, on every app, turns a low-risk security fix into a months-long program. For most apps that ceremony is out of proportion to the risk.
  • Oracle bills your whole headcount
    Oracle's Java SE Universal Subscription is priced per employee, not per install. A handful of forgotten Oracle JDKs can put your entire workforce in scope.
What we do

Tools and services for the whole JVM lifecycle

Start with a read-only discovery engagement that needs no change approval. Everything after it is scoped by what the discovery finds.
JVM Discovery & Estate Assessment
Find every JVM in your estate, including the ones bundled inside vendor products and containers, and turn the findings into a prioritized, costed remediation plan.
Learn more
Oracle Java Licensing & OpenJDK Migration
Quantify your Oracle Java SE exposure, then move every install that doesn't need Oracle onto a free, drop-in OpenJDK build, with evidence you can take to an audit or renewal.
Learn more
Rapid Patch
Patch the long tail of non-business-critical Java apps in days, not quarters, by replacing full regression testing with progressive rollout, fast detection and rehearsed rollback.
Learn more
Critical Patch Assurance
For business-critical Java applications, we compress testing instead of removing it, so full rigor fits a faster patch cadence.
Learn more
Vendor & Third-Party Application JVMs
Advisory for the Java you don't build yourself, including commercial products, appliances and vendor-bundled runtimes, so they get patched or protected instead of forgotten.
Learn more
Continuous Drift Monitoring
Keep your JVM inventory, patch posture and Oracle license exposure current as the estate changes, instead of commissioning a new assessment every year.
Learn more
How it works

Discover, classify, patch, stay current

Speed without recklessness comes from treating the estate proportionally: rigor where it matters, velocity everywhere else.
1

Discover

Agentless scanning plus CMDB, cloud and artifact-repository data finds every JVM: version, vendor, patch level, embedded agents and owner.

2

Classify

A documented, weighted scoring model sorts each app into the right patching tier, with evidence your risk function and CAB can sign off on.

3

Patch

Rapid Patch for the long tail, Critical Patch Assurance for the apps that run the business. Different risk, different process.

4

Stay current

Drift monitoring catches new JVMs, missed patches, new CVEs and new license exposure as the estate changes.

Two tiers, two different promises

Not every app deserves the same patch process

Business-critical systems and the long tail of internal tools carry very different risk. Treating them identically is why patch cycles stall.
Rapid Patch
For non-business-critical apps. We replace full pre-deployment regression testing with progressive rollout, automated health checks and fast, rehearsed rollback.
  • Canary 1% → 10% → 100%, gated on health signals
  • Smoke tests and synthetic transactions instead of full regression runs
  • Patch cycles measured in days
Critical Patch Assurance
For the apps that run the business. We don't remove testing, we compress it, so full rigor fits a faster cadence.
  • Risk-based test selection and shadow-traffic diffing
  • Canary gates on business metrics, not just latency
  • Scheduled patch trains with live war-room support
Why a specialist

Built for speed, not billable hours

Large consultancies do good work, but their commercial model rewards long programs. Ours rewards finishing.
Typical large-SI program Patchmageddon
Engagement shapeMulti-year program, open-ended SOWFixed price, fixed duration
First deliverableMonths into a discovery phaseDays for a Quick Scan, weeks for a full estate
First patch appliedOften a year or more inWeeks after the assessment closes
SpecializationJVM patching is one line in a broad portfolioThis is the entire practice
Billing incentiveTime & materials rewards durationFixed scope rewards speed
Articles

Latest from the field

Practical writing on JVM patching, Oracle Java licensing and OpenJDK migration.
All articles
Oracle Java Licensing

Oracle JDK 21's free update window has closed. Here's what that means.

Oracle JDK 21 updates released after September 2026 are no longer free for production use. Your options: pay, stop patching, or migrate to OpenJDK.
6 min read
Oracle Java Licensing

How Oracle's employee-based Java metric works, and why a few installs can price your whole company

Oracle's Java SE Universal Subscription is priced per employee, not per install. How the metric works, a worked example, and why your inventory drives the cost.
5 min read
OpenJDK Migration

Oracle JDK to OpenJDK: a practical migration checklist

A step-by-step checklist for moving from Oracle JDK to an OpenJDK build: choosing a distribution, what differs between vendors, verification and cleanup.
6 min read

Find out what's actually running in your estate

A Quick Scan inventories the JVMs in one business unit in days. You get versions, vendors, patch levels, CVE exposure and Oracle licensing exposure, with no production changes and no CAB ticket.
Book a Quick ScanSee all services