About Patchmageddon

A small, specialist company that does one thing, keeping enterprise Java estates patched, supported and correctly licensed, and does it fast.

Why we exist

Every quarter a new batch of Java security fixes ships, and every quarter most large organizations fall further behind. Most of them already have tools. What they lack is an accurate list of where their JVMs are, a process their risk function will approve, and anyone whose whole job is getting this done.

Oracle's move to employee-based Java pricing added a second, more expensive problem. Stray Oracle JDK installs that nobody tracked can now put an entire workforce in scope for a subscription.

We started Patchmageddon to solve both problems, quickly.

What we believe

Inventory comes first

You can't patch, migrate or license what you can't find. Every engagement starts from an accurate picture of what's actually running.

Risk is not uniform

A low-traffic internal tool and a payments service shouldn't go through the same patch process. Proportional rigor is how you get both speed and safety.

Speed is the product

Fixed-scope, fixed-price engagements measured in days and weeks. Our commercial model rewards finishing, not extending.

Evidence over assurances

Every classification, rollout and rollback leaves an audit trail your CAB, security team and auditors can check.

Tools and services

We are a services company built on our own tooling. Discovery, risk scoring, classification and drift monitoring are all automated, so every engagement is consistent and repeatable instead of a spreadsheet rebuilt by hand. That tooling is also why we can quote fixed prices and short timelines.

We work alongside the scanners and platforms you already own, not in place of them. Our value is the JVM-specific layer: what the findings mean for your Java estate and what to do about them.

Vendor neutral

We don't resell any JDK distribution. If an Oracle subscription is the right answer for some of your workloads, we'll say so. If Temurin, Corretto, Zulu, Red Hat or Microsoft's build is a better fit, we'll say that instead and explain why.

Get in touch

The fastest way to see what we do is a Quick Scan of one business unit. It's read-only, takes days, and you'll know exactly what's running.