[{"data":1,"prerenderedAt":865},["ShallowReactive",2],{"services":3,"page-\u002Fabout":776},[4,257,383,502,603,693],{"id":5,"title":6,"body":7,"category":238,"description":239,"engagement":240,"extension":241,"headline":242,"icon":243,"meta":244,"navigation":245,"order":246,"outcomes":247,"path":253,"seo":254,"stem":255,"__hash__":256},"services\u002Fservices\u002Fjvm-discovery.md","JVM Discovery & Estate Assessment",{"type":8,"value":9,"toc":228},"minimark",[10,15,24,27,31,34,79,83,93,125,129,206,210],[11,12,14],"h2",{"id":13},"the-problem","The problem",[16,17,18,19,23],"p",{},"Most enterprises can't produce an accurate, current list of the Java runtimes they run. The CMDB records some. Config management records others. The rest are ",[20,21,22],"strong",{},"shadow JVMs",": runtimes bundled inside vendor products, application servers, CI\u002FCD agents, monitoring tools, desktop software and container images that nobody thinks of as \"Java\".",[16,25,26],{},"Shadow JVMs are the ones that miss every patch cycle. For Oracle Java, they are also the installs that can put your entire headcount in scope for a subscription.",[11,28,30],{"id":29},"what-we-find","What we find",[16,32,33],{},"For every JVM across dev, staging and production we capture:",[35,36,37,44,50,56,62,68],"ul",{},[38,39,40,43],"li",{},[20,41,42],{},"Version, vendor and patch level",": Oracle JDK, Eclipse Temurin, Amazon Corretto, Azul Zulu, Red Hat, Microsoft, IBM Semeru and others",[38,45,46,49],{},[20,47,48],{},"Where it is embedded",": standalone apps, Tomcat, WebLogic, WebSphere, JBoss\u002FWildFly, vendor products, containers",[38,51,52,55],{},[20,53,54],{},"CVE exposure",", mapped to each version and scored so the worst exposure rises to the top",[38,57,58,61],{},[20,59,60],{},"Installed agents",": APM, security and profiling agents, which cause many patch failures",[38,63,64,67],{},[20,65,66],{},"Ownership",": who actually runs each application. This is often the hardest part to get right.",[38,69,70,73,74],{},[20,71,72],{},"Criticality signals"," that feed ",[75,76,78],"a",{"href":77},"\u002Fapproach#classification","application classification",[11,80,82],{"id":81},"how-we-do-it","How we do it",[84,85,86],"note",{},[16,87,88,89,92],{},"Discovery is ",[20,90,91],{},"read-only",". Nothing is patched, restarted or deployed, so the engagement doesn't need change-control approval, and the access we ask for is kept to a minimum.",[35,94,95,101,107,113,119],{},[38,96,97,100],{},[20,98,99],{},"Agentless scanning"," over SSH and WinRM (process listings and filesystem inspection) where possible",[38,102,103,106],{},[20,104,105],{},"Reconciliation against your CMDB and config management"," (Ansible, Puppet, Chef). The drift between what is recorded and what is running is a finding in its own right.",[38,108,109,112],{},[20,110,111],{},"Cloud provider APIs"," (AWS, Azure, GCP) for instance and container metadata",[38,114,115,118],{},[20,116,117],{},"Container image and artifact repository scanning"," (registries, Nexus, Artifactory) to catch JVMs before they are even running",[38,120,121,124],{},[20,122,123],{},"Reuse of the scanners you already own",". Tenable, Qualys, Snyk and JFrog Xray already collect useful data. We add the JVM-specific interpretation and a remediation plan; we don't sell you another scanner.",[11,126,128],{"id":127},"three-ways-to-engage","Three ways to engage",[130,131,132,151],"table",{},[133,134,135],"thead",{},[136,137,138,142,145,148],"tr",{},[139,140,141],"th",{},"Package",[139,143,144],{},"Scope",[139,146,147],{},"Turnaround",[139,149,150],{},"Purpose",[152,153,154,171,187],"tbody",{},[136,155,156,162,165,168],{},[157,158,159],"td",{},[20,160,161],{},"Quick Scan",[157,163,164],{},"One business unit or subset of the estate",[157,166,167],{},"Days",[157,169,170],{},"Prove what a full assessment will find",[136,172,173,178,181,184],{},[157,174,175],{},[20,176,177],{},"Full Estate Assessment",[157,179,180],{},"The whole estate",[157,182,183],{},"2–4 weeks",[157,185,186],{},"Complete inventory, risk report and remediation plan",[136,188,189,197,200,203],{},[157,190,191],{},[20,192,193],{},[75,194,196],{"href":195},"\u002Fservices\u002Fdrift-monitoring","Continuous Drift Monitoring",[157,198,199],{},"Ongoing",[157,201,202],{},"Subscription",[157,204,205],{},"Keep the inventory, risk and license picture current",[11,207,209],{"id":208},"what-you-walk-away-with","What you walk away with",[16,211,212,213,217,218,222,223,227],{},"The executive summary puts the findings in business terms: unbudgeted license exposure, days of exposure on unpatched critical CVEs, and the percentage of the estate on end-of-life versions. It ends with a direct recommendation of which applications belong in ",[75,214,216],{"href":215},"\u002Fservices\u002Frapid-patch","Rapid Patch",", which need ",[75,219,221],{"href":220},"\u002Fservices\u002Fcritical-patch-assurance","Critical Patch Assurance",", and which Oracle installs to ",[75,224,226],{"href":225},"\u002Fservices\u002Fopenjdk-migration","migrate or keep",".",{"title":229,"searchDepth":230,"depth":231,"links":232},"",2,3,[233,234,235,236,237],{"id":13,"depth":230,"text":14},{"id":29,"depth":230,"text":30},{"id":81,"depth":230,"text":82},{"id":127,"depth":230,"text":128},{"id":208,"depth":230,"text":209},"jvm-discovery","Find every JVM in your estate, including the ones bundled inside vendor products and containers, and turn the findings into a prioritized, costed remediation plan.","Read-only and fixed-price. A Quick Scan of one business unit takes days; a Full Estate Assessment takes two to four weeks. Nothing changes in production, so no CAB approval is needed.","md","Start here","i-lucide-radar",{},true,1,[248,249,250,251,252],"A complete inventory of every JVM, with version, vendor, patch level and location","CVE exposure scored per JVM, not a raw vulnerability count","Oracle Java license exposure quantified in dollars","Owners mapped for each application","An executive summary with a prioritized remediation plan","\u002Fservices\u002Fjvm-discovery",{"title":6,"description":239},"services\u002Fjvm-discovery","xwCt4w5iuENInyc5KpzKLmV4sk8GzNe5e1H4Q9b7mV8",{"id":258,"title":259,"body":260,"category":368,"description":369,"engagement":370,"extension":241,"headline":371,"icon":372,"meta":373,"navigation":245,"order":230,"outcomes":374,"path":225,"seo":380,"stem":381,"__hash__":382},"services\u002Fservices\u002Fopenjdk-migration.md","Oracle Java Licensing & OpenJDK Migration",{"type":8,"value":261,"toc":358},[262,266,273,279,287,293,297,302,309,313,316,320,323,327,335,339],[11,263,265],{"id":264},"why-this-is-urgent","Why this is urgent",[16,267,268,269,272],{},"Since January 2023, Oracle has sold Java SE through the ",[20,270,271],{},"Java SE Universal Subscription",", which is priced per employee rather than per installation. The count covers full-time, part-time and temporary staff, plus contractors who support internal operations, however few machines actually run Oracle Java.",[16,274,275,276,227],{},"So a handful of forgotten Oracle JDK installs can put your whole headcount in scope. For example, an organization of 5,000 employees running Oracle Java on 40 servers can face a list-price bill of around ",[20,277,278],{},"$630,000 a year",[16,280,281,282,286],{},"The free window is closing too. Oracle's No-Fee Terms and Conditions (NFTC) cover each LTS release only until one year after the next LTS ships. For Oracle JDK 21, that window ",[75,283,285],{"href":284},"\u002Farticles\u002Fjava-21-nftc-free-period-ended","closed on September 16, 2026",". Continuing to patch it now requires a paid subscription.",[288,289,290],"warning",{},[16,291,292],{},"We are not lawyers, and nothing here is legal advice. Licensing terms and prices change; check them against Oracle's current price list and your own agreements. Where a formal licensing position is needed, we work alongside independent licensing specialists.",[11,294,296],{"id":295},"what-we-do","What we do",[298,299,301],"h3",{"id":300},"_1-quantify-the-exposure","1. Quantify the exposure",[16,303,304,305,308],{},"Using the ",[75,306,307],{"href":253},"discovery inventory",", we identify every Oracle JDK and JRE, how it got there, and whether it is covered by another product's license. Then we put a number on what it costs you.",[298,310,312],{"id":311},"_2-decide-install-by-install","2. Decide, install by install",[16,314,315],{},"Most Oracle installs have no reason to be Oracle. A few do: vendor certification requirements or specific support needs. We make that call explicitly for each install instead of by default.",[298,317,319],{"id":318},"_3-migrate","3. Migrate",[16,321,322],{},"OpenJDK builds from Eclipse Adoptium (Temurin), Amazon (Corretto), Azul (Zulu), Red Hat and Microsoft are TCK-tested and free to use in production. For same-version swaps, migration is usually low risk, but not zero risk. We check for the known differences: truststore contents, installer paths and registry keys, fonts, and old commercial-feature flags. Then we roll out progressively.",[298,324,326],{"id":325},"_4-prove-it","4. Prove it",[16,328,329,330,334],{},"Uninstalling is not the same as re-pointing ",[331,332,333],"code",{},"JAVA_HOME",". We verify that Oracle binaries are actually gone and keep the evidence, which you will want if Oracle ever asks.",[11,336,338],{"id":337},"further-reading","Further reading",[35,340,341,346,352],{},[38,342,343],{},[75,344,345],{"href":284},"Oracle JDK 21's free update window has closed",[38,347,348],{},[75,349,351],{"href":350},"\u002Farticles\u002Foracle-java-employee-metric-explained","Oracle's employee-based Java pricing, explained",[38,353,354],{},[75,355,357],{"href":356},"\u002Farticles\u002Foracle-jdk-to-openjdk-migration-checklist","An Oracle JDK to OpenJDK migration checklist",{"title":229,"searchDepth":230,"depth":231,"links":359},[360,361,367],{"id":264,"depth":230,"text":265},{"id":295,"depth":230,"text":296,"children":362},[363,364,365,366],{"id":300,"depth":231,"text":301},{"id":311,"depth":231,"text":312},{"id":318,"depth":231,"text":319},{"id":325,"depth":231,"text":326},{"id":337,"depth":230,"text":338},"oracle-licensing","Quantify your Oracle Java SE exposure, then move every install that doesn't need Oracle onto a free, drop-in OpenJDK build, with evidence you can take to an audit or renewal.","Fixed-scope. We start from the discovery inventory, size your exposure, then migrate in waves. Low-criticality apps go first via Rapid Patch.","Often pays for itself","i-lucide-arrow-right-left",{},[375,376,377,378,379],"Your Oracle Java license exposure, in dollars, with the installs that drive it","A keep-or-migrate decision for every Oracle JDK install","Migration to Temurin, Corretto, Zulu, Red Hat or Microsoft builds of OpenJDK","Verified removal of Oracle binaries, with an evidence trail","Data to negotiate from ahead of an audit or renewal",{"title":259,"description":369},"services\u002Fopenjdk-migration","0aWf4Vd_7P0phaKwOWxq3bLjO4iX8gdRjDu_tPGAWBY",{"id":384,"title":216,"body":385,"category":488,"description":489,"engagement":490,"extension":241,"headline":491,"icon":492,"meta":493,"navigation":245,"order":231,"outcomes":494,"path":215,"seo":499,"stem":500,"__hash__":501},"services\u002Fservices\u002Frapid-patch.md",{"type":8,"value":386,"toc":482},[387,391,394,401,405,412,424,428,465,471,475],[11,388,390],{"id":389},"the-premise","The premise",[16,392,393],{},"Full regression testing before every JVM security patch is the main reason enterprise patch cycles take months. For business-critical systems that rigor is warranted. For the long tail of internal tools, batch jobs and low-traffic services it usually isn't. There it just delays the fix for a known CVE.",[16,395,396,397,400],{},"Rapid Patch ",[20,398,399],{},"does not skip testing",". It replaces pre-deployment regression testing with fast detection and fast rollback. If a bad patch is caught in minutes and reversed in minutes, running without an exhaustive test suite costs very little.",[11,402,404],{"id":403},"who-its-for","Who it's for",[16,406,407,408,411],{},"Applications that score below the critical threshold in our ",[75,409,410],{"href":77},"classification process",". This is a documented, weighted score with a named risk-acceptor, not an app owner's self-assessment. Apps near the threshold go to manual review.",[16,413,414,415,418,419,423],{},"Rapid Patch covers ",[20,416,417],{},"same-major security patches"," (for example 17.0.x to the next 17.0.x). Major version upgrades and vendor swaps are ",[75,420,422],{"href":421},"\u002Fapproach#patch-types","different engagements"," with a different risk profile.",[11,425,427],{"id":426},"how-it-works","How it works",[35,429,430,436,442,448,454],{},[38,431,432,435],{},[20,433,434],{},"Progressive rollout",": canary at 1%, then 10%, then 100%, gated on automated health checks",[38,437,438,441],{},[20,439,440],{},"Observability as the safety net",": error rates, latency, GC pause times, heap and thread behavior compared before and after the patch",[38,443,444,447],{},[20,445,446],{},"Fast, rehearsed rollback",": the previous runtime stays in place until the soak period ends, and rollback is exercised, not just written down",[38,449,450,453],{},[20,451,452],{},"Smoke tests and synthetic transactions"," for the paths that matter, in place of a full regression suite",[38,455,456,459,460,464],{},[20,457,458],{},"A pre-flight check"," for ",[75,461,463],{"href":462},"\u002Farticles\u002Fjvm-patch-failure-modes","known failure modes",": APM agents, TLS defaults, GC flags",[466,467,468],"tip",{},[16,469,470],{},"In many non-containerized estates, reliable rollback is the real gap. When that's the case we fix it first, because that step alone makes the patch cycle faster.",[11,472,474],{"id":473},"governance","Governance",[16,476,477,478],{},"Your Change Advisory Board approves the process once, as a standard change for a defined tier, instead of approving each patch. Every rollout produces evidence: which signals were checked, the results, timestamps, and who accepted the risk. ",[75,479,481],{"href":480},"\u002Farticles\u002Fcab-approval-for-faster-jvm-patching","How we get this past a CAB →",{"title":229,"searchDepth":230,"depth":231,"links":483},[484,485,486,487],{"id":389,"depth":230,"text":390},{"id":403,"depth":230,"text":404},{"id":426,"depth":230,"text":427},{"id":473,"depth":230,"text":474},"patch-management","Patch the long tail of non-business-critical Java apps in days, not quarters, by replacing full regression testing with progressive rollout, fast detection and rehearsed rollback.","Fixed-scope rollout of a patching pipeline and governance model for a defined tier of applications, followed by patch cycles run each quarter.","For non-critical apps","i-lucide-zap",{},[495,496,497,498],"Security patches applied across the tier in days after each quarterly release","Progressive rollout with automated health gates","A rollback path that has been tested, not just documented","A CAB-approved standard-change process and audit trail",{"title":216,"description":489},"services\u002Frapid-patch","qDIP1lgG0nnDOEyokq47L3LSfKbmYPHSlBnCXM3udLw",{"id":503,"title":221,"body":504,"category":588,"description":589,"engagement":590,"extension":241,"headline":591,"icon":592,"meta":593,"navigation":245,"order":594,"outcomes":595,"path":220,"seo":600,"stem":601,"__hash__":602},"services\u002Fservices\u002Fcritical-patch-assurance.md",{"type":8,"value":505,"toc":576},[506,510,517,523,527,531,534,538,541,545,548,552,555,559,562,566,569,573],[11,507,509],{"id":508},"a-different-promise","A different promise",[16,511,512,513,516],{},"For business-critical applications the value proposition flips. We aren't removing testing. We ",[20,514,515],{},"compress"," it so that each test cycle is shorter and gives you more confidence, and full rigor becomes possible on a faster cadence.",[16,518,519,520,522],{},"This is a different engagement from ",[75,521,216],{"href":215},", built on a different premise, not the same thing done more carefully.",[11,524,526],{"id":525},"whats-in-it","What's in it",[298,528,530],{"id":529},"test-impact-analysis-and-risk-based-test-selection","Test impact analysis and risk-based test selection",[16,532,533],{},"We use code coverage and change-impact analysis to find which of your existing regression tests actually exercise code paths affected by the JVM change, and run those on a compressed timeline. When the signal is ambiguous we escalate to the full suite.",[298,535,537],{"id":536},"shadow-traffic-and-dark-launch-testing","Shadow traffic and dark launch testing",[16,539,540],{},"We mirror real production traffic to a shadow instance running the patched JVM and diff its outputs against production, with no user exposure. This is the strongest \"test better, not less\" option available for critical services.",[298,542,544],{"id":543},"upgrade-readiness-assessment","Upgrade readiness assessment",[16,546,547],{},"Before any patch or upgrade, we scan for removed and deprecated API usage, known agent incompatibilities and dependency issues, and produce a risk report up front.",[298,549,551],{"id":550},"staging-and-production-parity-audits","Staging and production parity audits",[16,553,554],{},"Much critical-app patch risk comes from drift between staging and production, not from the patch itself. Closing that gap often gives you more than adding tests does.",[298,556,558],{"id":557},"canary-gates-on-business-metrics","Canary gates on business metrics",[16,560,561],{},"We go beyond latency and error rates to business invariants, such as transaction success rate, order completion and revenue per minute, and use them as automated rollback triggers.",[298,563,565],{"id":564},"patch-trains-and-war-room-support","Patch trains and war-room support",[16,567,568],{},"Scheduled, batched patch windows for critical apps, with dedicated live support during rollout, instead of ad hoc patching.",[298,570,572],{"id":571},"lts-aligned-strategy-and-vendor-coordination","LTS-aligned strategy and vendor coordination",[16,574,575],{},"Critical apps stay on designated LTS and security baselines, which keeps exposure windows short without constant churn. Where it matters, we work directly with your JVM vendor on compatibility and support commitments.",{"title":229,"searchDepth":230,"depth":231,"links":577},[578,579],{"id":508,"depth":230,"text":509},{"id":525,"depth":230,"text":526,"children":580},[581,582,583,584,585,586,587],{"id":529,"depth":231,"text":530},{"id":536,"depth":231,"text":537},{"id":543,"depth":231,"text":544},{"id":550,"depth":231,"text":551},{"id":557,"depth":231,"text":558},{"id":564,"depth":231,"text":565},{"id":571,"depth":231,"text":572},"risk-governance","For business-critical Java applications, we compress testing instead of removing it, so full rigor fits a faster patch cadence.","A higher-touch engagement for critical applications, typically starting with an upgrade-readiness assessment and continuing with scheduled patch trains.","For the apps that run the business","i-lucide-shield",{},4,[596,597,598,599],"Shorter test cycles for critical apps with the same or greater confidence","Shadow-traffic validation with no user exposure","Canary gates on business metrics, not just infrastructure metrics","Scheduled patch trains with live war-room support",{"title":221,"description":589},"services\u002Fcritical-patch-assurance","utoXA8F7946svO9yfDqjkPV5VtPJhDVhuelRoxSfZeU",{"id":604,"title":605,"body":606,"category":676,"description":677,"engagement":678,"extension":241,"headline":679,"icon":680,"meta":681,"navigation":245,"order":682,"outcomes":683,"path":689,"seo":690,"stem":691,"__hash__":692},"services\u002Fservices\u002Fthird-party-applications.md","Vendor & Third-Party Application JVMs",{"type":8,"value":607,"toc":672},[608,612,622,625,627,667],[11,609,611],{"id":610},"the-jvms-nobody-owns","The JVMs nobody owns",[16,613,614,615,618,619,227],{},"A large share of the Java in an enterprise wasn't written there. Application servers, database tooling, CI\u002FCD servers, monitoring agents, ETL tools, security appliances and desktop software often ship their ",[20,616,617],{},"own private JVM",", installed outside the package manager and invisible to anything that only checks the system ",[331,620,621],{},"java",[16,623,624],{},"These runtimes fall between two chairs. The platform team assumes the vendor patches them; the vendor assumes you'll apply their next release; the application owner assumes it's all fine. Meanwhile the bundled JVM ages.",[11,626,296],{"id":295},[35,628,629,639,645,655,661],{},[38,630,631,634,635,638],{},[20,632,633],{},"Find and attribute them."," ",[75,636,637],{"href":253},"Discovery"," surfaces bundled runtimes and ties each one to a product, version and business owner.",[38,640,641,644],{},[20,642,643],{},"Establish the supportability position."," For each product: does the vendor ship JVM updates, do they support replacing the bundled runtime, and which JDK builds do they certify?",[38,646,647,650,651,654],{},[20,648,649],{},"Patch what can be patched."," Through vendor updates or supported runtime swaps, rolled out with the same ",[75,652,653],{"href":215},"detection and rollback discipline"," as your own apps.",[38,656,657,660],{},[20,658,659],{},"Protect what can't."," Network isolation, disabling vulnerable features, tighter access. The compensating controls are documented so your risk register reflects reality.",[38,662,663,666],{},[20,664,665],{},"Take it to the vendor."," Certified-JDK questions, SBOM requests and patch-timeline commitments, backed by the specific evidence you need for a contract conversation.",[84,668,669],{},[16,670,671],{},"Some commercial products include a restricted Oracle Java license for use with that product only. Whether a bundled Oracle runtime creates licensing exposure depends on the product's terms, so we check them rather than assuming either way.",{"title":229,"searchDepth":230,"depth":231,"links":673},[674,675],{"id":610,"depth":230,"text":611},{"id":295,"depth":230,"text":296},"third-party-apps","Advisory for the Java you don't build yourself, including commercial products, appliances and vendor-bundled runtimes, so they get patched or protected instead of forgotten.","Advisory engagement scoped per vendor portfolio, usually following a discovery engagement that surfaces the bundled runtimes.","Second- and third-party apps","i-lucide-package",{},5,[684,685,686,687],"Every vendor-bundled JVM identified and attributed to a product and owner","A supportability position for each (vendor update, supported JRE swap or neither)","Compensating controls where patching isn't possible",{"Vendor asks backed by evidence":688},"certified JDKs, SBOMs, patch timelines","\u002Fservices\u002Fthird-party-applications",{"title":605,"description":677},"services\u002Fthird-party-applications","oy1ThKLwcn-G3Z5DaUWp8Maj1EXsbbInm5duRfzyfRs",{"id":694,"title":196,"body":695,"category":238,"description":763,"engagement":764,"extension":241,"headline":202,"icon":765,"meta":766,"navigation":245,"order":767,"outcomes":768,"path":195,"seo":773,"stem":774,"__hash__":775},"services\u002Fservices\u002Fdrift-monitoring.md",{"type":8,"value":696,"toc":758},[697,701,704,707,711,747,751],[11,698,700],{"id":699},"assessments-go-stale","Assessments go stale",[16,702,703],{},"An estate assessment is accurate the day it's delivered. After that, teams deploy new services, vendors ship updates with new bundled runtimes, someone installs Oracle JDK on a build agent, and a new CVE lands against a version you thought was fine.",[16,705,706],{},"Continuous Drift Monitoring keeps the picture current. The inventory becomes a system of record instead of a PDF.",[11,708,710],{"id":709},"what-it-watches","What it watches",[35,712,713,719,725,731,737],{},[38,714,715,718],{},[20,716,717],{},"New and undocumented JVMs"," across hosts, containers and artifact repositories",[38,720,721,724],{},[20,722,723],{},"Patch-level drift",": which runtimes fell behind after each quarterly critical patch update",[38,726,727,730],{},[20,728,729],{},"New CVEs"," against the versions and dependencies you actually run",[38,732,733,736],{},[20,734,735],{},"License exposure changes",": a new Oracle JDK install is flagged before it shows up in an audit",[38,738,739,742,743,746],{},[20,740,741],{},"Classification triggers",", such as a new regulated data flow, a traffic spike or an incident, which force an application's ",[75,744,745],{"href":77},"risk tier"," to be re-scored",[11,748,750],{"id":749},"how-its-delivered","How it's delivered",[16,752,753,754,757],{},"Collection reuses the minimum-privilege methods from the ",[75,755,756],{"href":253},"original assessment",". Findings go to a shared dashboard and to the channels your teams already use. Each quarter, aligned to the Java patch calendar, we review drift, exposure and upcoming end-of-life dates with you.",{"title":229,"searchDepth":230,"depth":231,"links":759},[760,761,762],{"id":699,"depth":230,"text":700},{"id":709,"depth":230,"text":710},{"id":749,"depth":230,"text":750},"Keep your JVM inventory, patch posture and Oracle license exposure current as the estate changes, instead of commissioning a new assessment every year.","Ongoing subscription after an estate assessment. Continuous collection, alerting on meaningful changes, and a quarterly review aligned to the Java patch calendar.","i-lucide-refresh-cw",{},6,[769,770,771,772],"New and undocumented JVMs detected as they appear","Patch-level drift tracked against each quarterly release","Alerts when a new install creates Oracle license exposure","Automatic re-classification when an app's risk profile changes",{"title":196,"description":763},"services\u002Fdrift-monitoring","Phmhi-GcB9IZ5dN4HFjsW_dg9QF_D9rXUNzILnRNAKE",{"id":777,"title":778,"body":779,"description":859,"extension":241,"meta":860,"navigation":245,"path":861,"seo":862,"stem":863,"__hash__":864},"pages\u002Fabout.md","About Patchmageddon",{"type":8,"value":780,"toc":852},[781,785,788,791,794,798,824,828,831,834,838,841,845],[11,782,784],{"id":783},"why-we-exist","Why we exist",[16,786,787],{},"Every quarter a new batch of Java security fixes ships, and every quarter most large organizations fall further behind. Most of them already have tools. What they lack is an accurate list of where their JVMs are, a process their risk function will approve, and anyone whose whole job is getting this done.",[16,789,790],{},"Oracle's move to employee-based Java pricing added a second, more expensive problem. Stray Oracle JDK installs that nobody tracked can now put an entire workforce in scope for a subscription.",[16,792,793],{},"We started Patchmageddon to solve both problems, quickly.",[11,795,797],{"id":796},"what-we-believe","What we believe",[799,800,804,809,814,819],"u-page-grid",{"className":801},[802,803],"lg:grid-cols-2","my-8",[805,806],"u-page-card",{"description":807,"icon":243,"title":808},"You can't patch, migrate or license what you can't find. Every engagement starts from an accurate picture of what's actually running.","Inventory comes first",[805,810],{"description":811,"icon":812,"title":813},"A low-traffic internal tool and a payments service shouldn't go through the same patch process. Proportional rigor is how you get both speed and safety.","i-lucide-scale","Risk is not uniform",[805,815],{"description":816,"icon":817,"title":818},"Fixed-scope, fixed-price engagements measured in days and weeks. Our commercial model rewards finishing, not extending.","i-lucide-timer","Speed is the product",[805,820],{"description":821,"icon":822,"title":823},"Every classification, rollout and rollback leaves an audit trail your CAB, security team and auditors can check.","i-lucide-file-check-2","Evidence over assurances",[11,825,827],{"id":826},"tools-and-services","Tools and services",[16,829,830],{},"We are a services company built on our own tooling. Discovery, risk scoring, classification and drift monitoring are all automated, so every engagement is consistent and repeatable instead of a spreadsheet rebuilt by hand. That tooling is also why we can quote fixed prices and short timelines.",[16,832,833],{},"We work alongside the scanners and platforms you already own, not in place of them. Our value is the JVM-specific layer: what the findings mean for your Java estate and what to do about them.",[11,835,837],{"id":836},"vendor-neutral","Vendor neutral",[16,839,840],{},"We don't resell any JDK distribution. If an Oracle subscription is the right answer for some of your workloads, we'll say so. If Temurin, Corretto, Zulu, Red Hat or Microsoft's build is a better fit, we'll say that instead and explain why.",[11,842,844],{"id":843},"get-in-touch","Get in touch",[16,846,847,848,851],{},"The fastest way to see what we do is a ",[75,849,161],{"href":850},"\u002Fcontact?topic=quick-scan"," of one business unit. It's read-only, takes days, and you'll know exactly what's running.",{"title":229,"searchDepth":230,"depth":231,"links":853},[854,855,856,857,858],{"id":783,"depth":230,"text":784},{"id":796,"depth":230,"text":797},{"id":826,"depth":230,"text":827},{"id":836,"depth":230,"text":837},{"id":843,"depth":230,"text":844},"A small, specialist company that does one thing, keeping enterprise Java estates patched, supported and correctly licensed, and does it fast.",{},"\u002Fabout",{"title":778,"description":859},"about","-QCPsXpim7e-fwGxDR3chdptFGse0f0Jf_EuDhMp9uQ",1790355850053]